8c089a32c696b02e05eec6731c09220fc72b079b71ba71a80f59de9663a88247

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DolphinAI.exe
Size 7.0MB
Sample260817-prphvsbm3w
SHA256 8c089a32c696b02e05eec6731c09220fc72b079b71ba71a80f59de9663a88247
MD5 1b6cc34a32cd804b95ed5b8b6ecdc293
SHA1 be35a07070061ad22bc6c433391103e51625b8e3
SHA512 51bc8daa879b29e3226ff2edd79a859c30334e85cf94733d103f107796c54e6596a93c6fcf0dabf9f902820eaa7b567e8d83c21f9a03c3aa63f6ae2afdc932d0
SSDEEP 98304:9/RLOIk9VMPfI5Vispavo/pRstSTQQCFceAxRSlmIM:949BBlRiS0Q8DADkM
TLSH
T14C769D0477A4C72BE26F8E32E8E90011D3F1E4526671EB4E66969EAC1D037857C4A37F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	DolphinAI.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	DolphinAI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	DolphinAI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	DolphinAI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	DolphinAI.exe

C:\Users\Admin\AppData\Local\Temp\DolphinAI.exe
"C:\Users\Admin\AppData\Local\Temp\DolphinAI.exe"
1⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads