715b3d8811e8c978988fcc2890c46793644ae3231bfe54252f77889395287e1c

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AppController.AllUsers.exe
Size 17.4MB
Sample260604-pl6j7afx2p
SHA256 715b3d8811e8c978988fcc2890c46793644ae3231bfe54252f77889395287e1c
MD5 25d0da01a112628224a8b546fb0868bb
SHA1 60b934c65137c1de359620dd3ccafc013a1e0186
SHA512 f7e954a73b661e1c637996dc729db8f28be1a4a470c11819c502829f519d01656119bf0c2346bb3340d4b6642e7451d06f2213ac70bf9e7afd87a527f60d87ea
SSDEEP 393216:uwGTcGaLmGI1hfORkZssfkZie++2WOOaHc+4I5Q/GKpWotnag:uwGoFmGIUkZjkZX+AaPmTp9tnag
TLSH
T12707333196251273F2F21377ED38B2247E3D7714270089BDE2E8DC6C5AA44A62BF7256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
644	AppController.AllUsers.exe

Loads dropped DLL 1 IoCs

pid	Process
644	AppController.AllUsers.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppController.AllUsers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppController.AllUsers.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 644	1544	AppController.AllUsers.exe	80

C:\Users\Admin\AppData\Local\Temp\AppController.AllUsers.exe
"C:\Users\Admin\AppData\Local\Temp\AppController.AllUsers.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\{3AA1883B-7FB0-427E-A765-61898C32FEB4}\.cr\AppController.AllUsers.exe
  "C:\Users\Admin\AppData\Local\Temp\{3AA1883B-7FB0-427E-A765-61898C32FEB4}\.cr\AppController.AllUsers.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\AppController.AllUsers.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppController.AllUsers.exe

Path C:\Users\Admin\AppData\Local\Temp\{3AA1883B-7FB0-427E-A765-61898C32FEB4}\.cr\AppController.AllUsers.exe
Size 996KB
SHA256 c2fa40acad989074b3c93066b249193f797a1271da21203b9818e40e4e01987e
MD5 93fe4e15e8f12bfa06985f5e1eeb0e8a
SHA1 34cd97744e1d7be9ad8492a0c7d54315c21c1fbb
SHA512 c6ba9ef1c4d0a8ab90bf63b37ccfd434340071f92dbfaceeb81b9e37645061d8fe5cf6a28cf7fca0923f56a6bb5d67cbbccc1794c2dad368f45897a47782b097
SSDEEP 24576:IgwYgb25FJsqIAkf5WxrdlHoWk6RKwbv3s:1gKu8BrdlHoaRlD3s
TLSH
T16B25C03295614032E7F106B3BD28A5307E7CE328175088AED3D8ED1D6EA84967BF7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cancel.png

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\Cancel.png
Size 3KB
SHA256 9e96a109a61cec7f706fb8878ea30ceb90c3915bf1a4a378528cbf78c5734bd7
MD5 6d8fa68ccc6b9e12e5c878e0b6012e57
SHA1 ade23d4fa3feebf17cdd13bf6244c4bb0738d034
SHA512 f6ee476b91ae4ecc9728c7aadbff2e61a4da53278cdc8a632598a83033c577eade068b82dc0a1b81c445cde4dcbc9fdd1e05bf0dc776de2739abb8d7935110c5
TLSH
T13D716CDB36B09A5C0F02CDFCE0F4254E80A7A16DAE711C184946612FD748F60C35714A
MD5 SHA1 SHA512 TLSH

Submit Download

Close.png

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\Close.png
Size 3KB
SHA256 35961cca2c9b6c61c8001bb281a3a8476da7c6b01a7831ebe5c98ba1a1998058
MD5 85060c7969bddaa791360d5f318433c6
SHA1 4dc7949d4e6c626f7f233a560f1b7d2fb523e290
SHA512 8cc4b165cef0452b14889ab2b1ac8198870e4b6a48b0495281ae676fd075d18878cca00448f1d06abb535e5c175aa2acfa9d1d9b467b658f0b2d1436ba3ac7e2
TLSH
T11C717DE1F65B5007A26B79D903750A6CFB230F06113B4743D809D4F93022402A9A5FFD
MD5 SHA1 SHA512 TLSH

Submit Download

Install.png

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\Install.png
Size 2KB
SHA256 6f85517cf622b29b8c0b83cf240cf1526701ac9a8f39b4c001066ee6b26e94c0
MD5 629bd293a25026629e9ca8fe7823541e
SHA1 df91724172e423ca1a619117346cc5111b4635ba
SHA512 cadc43b96a5972025f5527b135bd918a04cac0de27006d490c8b2dd1e515d324685c8f8437be8a048001322615bcfb88a82587020920c996b89663a652800802
TLSH
T15E514AA39AE411BCC7167C7253AED89DFA14A6704DDE27C952D9CC2A00928FB19C1FD3
MD5 SHA1 SHA512 TLSH

Submit Download

Repair.png

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\Repair.png
Size 3KB
SHA256 467eaeafe318b216716951aad73b3e1003373a141864b9cb61f49b2211be5cb7
MD5 07940373eac95d267906b145bb1d432d
SHA1 1f7650e04b3229d40e18d046027c29195fb43084
SHA512 e41780975bc4ded79e81e038365fead307c7b2945e0686d3b9d7cf5cc9ada5b0f9ea1189ff46f036e4a640a63bcc162aadfa0242db8c085ed236c6279d91b223
TLSH
T16B614F47814551DD4C203FFE49350FDA005611358F6F20625917DD397DAFDF02B952AE
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.png

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\Uninstall.png
Size 3KB
SHA256 9485b05c220bf6974e71cbae7dbf9b6df5dc455b4bd654f4d1b275562411406b
MD5 3d2bbf34c47d92e7a6010615c3edadc5
SHA1 e947352fac2c40c643149758340bfa5956fd0daf
SHA512 30cf97e73841913131d7397aa272a766fecf4ac38b745d833354cfee440a1c4137d7a3a9ff84f3423b00ccd34322d76a729ea531759b80b1cb0d5424ee767141
TLSH
T152614D1D0642321188F349789552F8AE5126B0ED12B11CA9A573FDBA8DC451397C1F7E
MD5 SHA1 SHA512 TLSH

Submit Download

background-client.png

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\background-client.png
Size 401KB
SHA256 54b7e1f283b51ca752b372a523e53fd7e65fd4975fb1ccc5431018a8376b94b5
MD5 f03d6693aaa40f0d14a27908f4f4d836
SHA1 ae806944aa5885ef6810786860ae2265fe5dc8b0
SHA512 97cf369db10088c310b1ba4dd6aa1ec82e21fd63a5ca5ad6d80cddd74926e670729c62b4a8a2c27324a0fcd0ef1a66c6c64f5948e8ad79ccf6c3f8405836076d
SSDEEP 6144:BgPNGKXTYITUIUsTqyn+VtPOjRuYWhQDQ0nkKyP2Y3766KxhGfhx/lwVyxfAV8fw:84IUY8eJWWDQMByP2O8UPCyVhn7ah
TLSH
T14594233206DD52F3C5334701AB94A5DAD1F92712A9621E2DCEE2D3BD985088EDCC4B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

white_small.png

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\white_small.png
Size 1KB
SHA256 57efa10fdbd2706408b4b9a1826c80b455f7d10c6754e6d69b1218e9afee5b79
MD5 23f9a79682ed3880d0d6fb76bd50203b
SHA1 08a6a698349c9eec272cb6525ae2c4dfbc317598
SHA512 711d35b58faf55799005724d4c63827bfcb7318a9f32158e33c38d7afe91c3db314bb840e236ef65bb426f5d733859e5bd23b8a235bc7a90a4f12e957d518556
TLSH
T17521BE18115904E7A13E531A82C8E68023B304363378EABCB9715D3D9587FEE53DAFC8
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{F9F1AF9E-53A7-4B15-854E-9CBBD6348D13}\.ba\wixstdba.dll
Size 175KB
SHA256 58a135101a2044d96f470e29369a8214c5c2add774488d73c6ae81a588582239
MD5 6ba2e331e0f447aaff0e8142df5f7230
SHA1 7a3f7fb93e7bdcf04fa83b50bde1d939b1864023
SHA512 e137eb9f07e3b8ed03b309dd63e4fa9a4993e53b6d54c4c77ac289609811144fd66b49126b1168ebe8fa80669a765a51c1e72444d8c4deace091b65708d67d3b
SSDEEP 3072:Z/iHBlNefDhpuHQJ6/SV6XR2KYvq2zdtoG6ih1+Jr5I9mJ/SLidr+WxhsEM1cZ2G:ZKhlNefVpkW/0R2KRqoG6q1a4HbEMqsG
TLSH
T16B047D1275C1907AE7FB1A3C593865716A7FBA240FA0C9DE57849D2B2DB00C1AB35B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads