c02af472c5308391e518d96ef9bd144a83ef33b35c27613bfec67ab4c8b01100

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
Size 1.2MB
Sample260813-eshrlazves
SHA256 c02af472c5308391e518d96ef9bd144a83ef33b35c27613bfec67ab4c8b01100
MD5 18257e5fd13e4ed60c6392bf846b5a6c
SHA1 ef5d82322f45af03d2009223236bb775d0f88218
SHA512 fb8b1481d83bcbaf9d80c0b2d1a1188ef9be90ee65a0e312680379bb89b0fa81c1f0f02e986ce55b88c4723e0d7104fc52ef66cf0b53d749d3a7aecac5b94cc1
SSDEEP 24576:P2+XQGb0WKBwDJ0YzZBWz/VLMy46Y/+cbQc:PzWwDJpPWzNLwR
TLSH
T1C4454B1657D8027CF0F7D2F8DEA69C42DB76780A07B19AEF06C055664E27BA08E39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AimCore\logs\installer.log	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
1088	AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe

C:\Users\Admin\AppData\Local\Temp\AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe
"C:\Users\Admin\AppData\Local\Temp\AimCoreAI-inst_VaATOsRvUKFUNj1RpJhGQMuc.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.log

Path C:\Program Files\AimCore\logs\installer.log
Size 2KB
SHA256 6fc4ffaad8b4655c8e2b9225a790d57163c5a63dec8affbc7ea613429579f044
MD5 82c9e93949d551a6cf11b3aaa6ad6653
SHA1 61614508a851d840ee1ec442c5dc51115ca79ec2
SHA512 c6e232a4a3a3b50a1acc04b27580041291131f991a424cf5afb1bc9c65dffd727a0d53649c24d4f695e25617c8512c5159509ede68cd5e28896bea39e4287e1f
TLSH
T19851310F8EE903B60D01424FE33E5EF663407213462A19359DEA034931D8D8F6ED71AD
MD5 SHA1 SHA512 TLSH

Submit Download

installer.log

Path C:\Program Files\AimCore\logs\installer.log
Size 1KB
SHA256 e0d8ee6803c412bc469b3b652a96d1772f9054a76be70fa4fb439e7192e0caad
MD5 b2c64dbc4544707dc280d49f27dc34f7
SHA1 6f06c7cfa64202638c45ce2f125298d6cdb01be1
SHA512 9082c2f1d5572974dd52db8ae764d9c898a53a52a616102b34223860c313fb843bccfbebf42c67180401ce51b125c9f6a8caa29d7a68734b18ca774bd51a51c3
TLSH
T136210F06CDED07E91E02824BE37E4EF287D0B04705AA1A689EF5524532C4D5A6EDB22D
MD5 SHA1 SHA512 TLSH

Submit Download