91d82c5afb8a386ba1ff1eaa47d01c72de9881b4c33886c8275ba23e072f5274

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AppController.AllUsers.exe
Size 36.2MB
Sample260604-phb66set4t
SHA256 91d82c5afb8a386ba1ff1eaa47d01c72de9881b4c33886c8275ba23e072f5274
MD5 a02fe007c9742fc8aabe8803fc443bf4
SHA1 822d3ae91652778bb731c4d822f0968103381cb0
SHA512 66db22a6fb9ccfe14cae4776d974d09446e444f475ea7087ac7450ff8eccb8fc311ac2edef4960dd7bf5216b61aacbeceeffdc40927cc5a9da6ac2bacdd52e10
SSDEEP 786432:oDKwcTZOnOSMyURdSZvi/VnUsfnZ6jMSzoXXZpgMyW:aoZeOIoUGJSUX/yW
TLSH
T1E587333292390435D6E60277BD68BE319E983324134448A5E3D8FCA96DF14E367BFB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
2328	AppController.AllUsers.exe

Loads dropped DLL 1 IoCs

pid	Process
2328	AppController.AllUsers.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppController.AllUsers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppController.AllUsers.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2328	656	AppController.AllUsers.exe	85

C:\Users\Admin\AppData\Local\Temp\AppController.AllUsers.exe
"C:\Users\Admin\AppData\Local\Temp\AppController.AllUsers.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\{CA2CEAB2-2425-499E-8CC3-40250EDAD590}\.cr\AppController.AllUsers.exe
  "C:\Users\Admin\AppData\Local\Temp\{CA2CEAB2-2425-499E-8CC3-40250EDAD590}\.cr\AppController.AllUsers.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\AppController.AllUsers.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppController.AllUsers.exe

Path C:\Users\Admin\AppData\Local\Temp\{CA2CEAB2-2425-499E-8CC3-40250EDAD590}\.cr\AppController.AllUsers.exe
Size 1.1MB
SHA256 b640784ce94c1a5ccba8ae98f0e4ecc0f77ffbd758a3fee325ccc5430d795f71
MD5 db919c494398c4bfbf74e9368fc0ecff
SHA1 59d8ddfdaaeda4b78f5e83f529223ee246928faf
SHA512 ca205c0eeb25564fd752d50ed81fb49a47e20c84c7dfe63bcf13d495385b231757e7c8670d6e34c9d6f09b4069c042c4d64293bf4477f32d46aa11c29b23f0fc
SSDEEP 24576:BgwYgb25FJsqIAiQGg6vwZWMCi89nhOaX71xUyaiLjK7:UgKu86xth3BxUyO7
TLSH
T1B935D03295614032E6F106B3BD2891307D7CE728275088AAE7D8ED1D7EB84D26BF7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cancel.png

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\Cancel.png
Size 3KB
SHA256 9e96a109a61cec7f706fb8878ea30ceb90c3915bf1a4a378528cbf78c5734bd7
MD5 6d8fa68ccc6b9e12e5c878e0b6012e57
SHA1 ade23d4fa3feebf17cdd13bf6244c4bb0738d034
SHA512 f6ee476b91ae4ecc9728c7aadbff2e61a4da53278cdc8a632598a83033c577eade068b82dc0a1b81c445cde4dcbc9fdd1e05bf0dc776de2739abb8d7935110c5
TLSH
T13D716CDB36B09A5C0F02CDFCE0F4254E80A7A16DAE711C184946612FD748F60C35714A
MD5 SHA1 SHA512 TLSH

Submit Download

Close.png

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\Close.png
Size 3KB
SHA256 35961cca2c9b6c61c8001bb281a3a8476da7c6b01a7831ebe5c98ba1a1998058
MD5 85060c7969bddaa791360d5f318433c6
SHA1 4dc7949d4e6c626f7f233a560f1b7d2fb523e290
SHA512 8cc4b165cef0452b14889ab2b1ac8198870e4b6a48b0495281ae676fd075d18878cca00448f1d06abb535e5c175aa2acfa9d1d9b467b658f0b2d1436ba3ac7e2
TLSH
T11C717DE1F65B5007A26B79D903750A6CFB230F06113B4743D809D4F93022402A9A5FFD
MD5 SHA1 SHA512 TLSH

Submit Download

Install.png

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\Install.png
Size 2KB
SHA256 6f85517cf622b29b8c0b83cf240cf1526701ac9a8f39b4c001066ee6b26e94c0
MD5 629bd293a25026629e9ca8fe7823541e
SHA1 df91724172e423ca1a619117346cc5111b4635ba
SHA512 cadc43b96a5972025f5527b135bd918a04cac0de27006d490c8b2dd1e515d324685c8f8437be8a048001322615bcfb88a82587020920c996b89663a652800802
TLSH
T15E514AA39AE411BCC7167C7253AED89DFA14A6704DDE27C952D9CC2A00928FB19C1FD3
MD5 SHA1 SHA512 TLSH

Submit Download

Repair.png

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\Repair.png
Size 3KB
SHA256 467eaeafe318b216716951aad73b3e1003373a141864b9cb61f49b2211be5cb7
MD5 07940373eac95d267906b145bb1d432d
SHA1 1f7650e04b3229d40e18d046027c29195fb43084
SHA512 e41780975bc4ded79e81e038365fead307c7b2945e0686d3b9d7cf5cc9ada5b0f9ea1189ff46f036e4a640a63bcc162aadfa0242db8c085ed236c6279d91b223
TLSH
T16B614F47814551DD4C203FFE49350FDA005611358F6F20625917DD397DAFDF02B952AE
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.png

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\Uninstall.png
Size 3KB
SHA256 9485b05c220bf6974e71cbae7dbf9b6df5dc455b4bd654f4d1b275562411406b
MD5 3d2bbf34c47d92e7a6010615c3edadc5
SHA1 e947352fac2c40c643149758340bfa5956fd0daf
SHA512 30cf97e73841913131d7397aa272a766fecf4ac38b745d833354cfee440a1c4137d7a3a9ff84f3423b00ccd34322d76a729ea531759b80b1cb0d5424ee767141
TLSH
T152614D1D0642321188F349789552F8AE5126B0ED12B11CA9A573FDBA8DC451397C1F7E
MD5 SHA1 SHA512 TLSH

Submit Download

background-client.png

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\background-client.png
Size 531KB
SHA256 3465fbb8d637f9d3300268f3346ab0f042f4a1ade8efcf490f8c17fb4b2d62b5
MD5 9ff27bbd2762d6d8f1890c0239e0e914
SHA1 416731fbf44fa9ad0f4b1409a494e60b056bd391
SHA512 30efbd06c5f9f9424b93df32d7342729ec4293b78910c0987770dd86ef76d5322c2275ce3415f9af9fe895d8b78fd7154b2605816007134dc55966924eaf65ca
SSDEEP 12288:S64ertddm6I5PhjS2ZXLGoW0TU0B2S1y0fuy:gerLdm/9hOsXLGKvy+H
TLSH
T155C42303AAC655A33CEF46A7397A60A0D0C81B9426B01CD571BDFD843FAE6D5D4A433E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

white_small.png

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\white_small.png
Size 1KB
SHA256 57efa10fdbd2706408b4b9a1826c80b455f7d10c6754e6d69b1218e9afee5b79
MD5 23f9a79682ed3880d0d6fb76bd50203b
SHA1 08a6a698349c9eec272cb6525ae2c4dfbc317598
SHA512 711d35b58faf55799005724d4c63827bfcb7318a9f32158e33c38d7afe91c3db314bb840e236ef65bb426f5d733859e5bd23b8a235bc7a90a4f12e957d518556
TLSH
T17521BE18115904E7A13E531A82C8E68023B304363378EABCB9715D3D9587FEE53DAFC8
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{F2AD3A21-D640-42A5-A220-E08D83593AE5}\.ba\wixstdba.dll
Size 175KB
SHA256 58a135101a2044d96f470e29369a8214c5c2add774488d73c6ae81a588582239
MD5 6ba2e331e0f447aaff0e8142df5f7230
SHA1 7a3f7fb93e7bdcf04fa83b50bde1d939b1864023
SHA512 e137eb9f07e3b8ed03b309dd63e4fa9a4993e53b6d54c4c77ac289609811144fd66b49126b1168ebe8fa80669a765a51c1e72444d8c4deace091b65708d67d3b
SSDEEP 3072:Z/iHBlNefDhpuHQJ6/SV6XR2KYvq2zdtoG6ih1+Jr5I9mJ/SLidr+WxhsEM1cZ2G:ZKhlNefVpkW/0R2KRqoG6q1a4HbEMqsG
TLSH
T16B047D1275C1907AE7FB1A3C593865716A7FBA240FA0C9DE57849D2B2DB00C1AB35B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads