c02af472c5308391e518d96ef9bd144a83ef33b35c27613bfec67ab4c8b01100

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
Size 1.2MB
Sample260813-eshrlazves
SHA256 c02af472c5308391e518d96ef9bd144a83ef33b35c27613bfec67ab4c8b01100
MD5 18257e5fd13e4ed60c6392bf846b5a6c
SHA1 ef5d82322f45af03d2009223236bb775d0f88218
SHA512 fb8b1481d83bcbaf9d80c0b2d1a1188ef9be90ee65a0e312680379bb89b0fa81c1f0f02e986ce55b88c4723e0d7104fc52ef66cf0b53d749d3a7aecac5b94cc1
SSDEEP 24576:P2+XQGb0WKBwDJ0YzZBWz/VLMy46Y/+cbQc:PzWwDJpPWzNLwR
TLSH
T1C4454B1657D8027CF0F7D2F8DEA69C42DB76780A07B19AEF06C055664E27BA08E39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AimCore\logs\installer.log	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2592	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
2592	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

C:\Users\Admin\AppData\Local\Temp\AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
"C:\Users\Admin\AppData\Local\Temp\AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.log

Path C:\Program Files\AimCore\logs\installer.log
Size 2KB
SHA256 d0f704d03fa52bddd2d89af3a9a931ce8d6f5dab1d64c9a2cf4e4c03c24930a7
MD5 f2893ee3fe9d33b1353a936cbca6a39f
SHA1 cc324af4e15990dc7cd93030043901b45018cc23
SHA512 08fa396e844bc8d4c4f91c46862544f343e897d3eb6c951c3c78ba6374291c942cc61d08d694e081fe247a07cb4a3a618c27e147cac46fa85ef4f438d33d259b
TLSH
T14251420BCDE902B61E01924AF33E4FF2E31172470572157959E6034E30D9D8FAEA76AD
MD5 SHA1 SHA512 TLSH

Submit Download

installer.log

Path C:\Program Files\AimCore\logs\installer.log
Size 1KB
SHA256 4abe71e880dcb53f855850c648e03cf8f7ee4441ed00148c288864e0289d5990
MD5 6ca02c939a84c42c98520ed686c67f81
SHA1 2093a6a6e6f3e35f10c64445d73309472c978256
SHA512 fe0ee085b2c44dab3f69e11e4e6221c31ed75646c3f51995e13c4be02abbe09b6b7e98566a4f887d8e4c2ee260b410888789126b2cb4ef5dd89eb8db1655930e
TLSH
T1F8210F0ACDDD07A91D428347E33E0EF2C354B24705A619689EF6526920C4D5E7FDB22C
MD5 SHA1 SHA512 TLSH

Submit Download