af2f0607d25e45251e58a4a5ce6bb0d1397faa334f963cb2208529698df11c17

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aria2.exe
Size 16KB
Sample260822-gybatafk6w
SHA256 af2f0607d25e45251e58a4a5ce6bb0d1397faa334f963cb2208529698df11c17
MD5 867a500cec870b8d3bea3ae536539c22
SHA1 9c2a8902612074bdbfabbe80d7808366b71865df
SHA512 4d8589e11813fcc75879f03ddc651216887d7f2d270c109875132803c290ddc617a3dd95e2edbea0ba892f1de74dd5fb3c1f34aea31ea1fb9c284ceee7a9bd5d
SSDEEP 192:SBxYNapkZ0+PoOMeF9wAndgMnzmE6HPmoynvXUUN4aHcdvIzZcM:+xaHZlgq9pzmXm9Xdt8dvu1
TLSH
T1BB721C5196E4E054F37535702771E63A225DFC6D0E33C9AA982FF2B86D3535C5C2221E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aria2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aria2c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3804	aria2.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3804	aria2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 5516	3804	aria2.exe	90

C:\Users\Admin\AppData\Local\Temp\aria2.exe
"C:\Users\Admin\AppData\Local\Temp\aria2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Users\Admin\AppData\Local\Temp\aria2c.exe
  aria2c --conf-path=aria2.conf -D
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5516-0-0x0000000000400000-0x00000000007E0000-memory.dmp

Download