24264e6186cb8c630737a989b9c5c1c685e40ee20da0e3e3ac60ad3a6f06c83b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
anygo.exe
Size 101.0MB
Sample260826-gr57lsgq21
SHA256 24264e6186cb8c630737a989b9c5c1c685e40ee20da0e3e3ac60ad3a6f06c83b
MD5 8b5b4c4d8df6231d0afe8cdd38ad7cfe
SHA1 bc77a0314940b31d13eaa5b591e6918d8f645675
SHA512 de048ecfab91f488c8f0102252dc261bbdc76aa9d1e309c91ac53486707375f1683b25e8693638d2e533a5d928193b983d2374cd09bd87e9c5e3cd391476d54f
SSDEEP 3145728:XRknxl6s9IVXeZpoFkrdkUhIpQnol4JcBo:WnL6jX8llhIpQnQ4WW
TLSH
T150383326F259B27DC0843738053B806488FBEDA9F2567E2366F4F958DBB10C05E7B616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery execution installer

Malware Config

Signatures

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
712	tasklist.exe

Executes dropped EXE 1 IoCs

pid	Process
3640	anygo.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3408	cmd.exe
3224	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anygo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anygo.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5576-0-0x0000000000400000-0x00000000004CD000-memory.dmp	innosetup
behavioral2/memory/5576-8-0x0000000000400000-0x00000000004CD000-memory.dmp	innosetup

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3144	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	712	tasklist.exe
Token: SeDebugPrivilege	3144	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 3640	5576	anygo.exe	89
PID 3640 wrote to memory of 3408	3640	anygo.tmp	90
PID 3640 wrote to memory of 3224	3640	anygo.tmp	92
PID 3408 wrote to memory of 3144	3408	cmd.exe	94
PID 3224 wrote to memory of 712	3224	cmd.exe	95
PID 3224 wrote to memory of 4560	3224	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\anygo.exe
"C:\Users\Admin\AppData\Local\Temp\anygo.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Users\Admin\AppData\Local\Temp\is-A397U.tmp\anygo.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A397U.tmp\anygo.tmp" /SL5="$40178,105162295,784384,C:\Users\Admin\AppData\Local\Temp\anygo.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im adb.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /t /im adb.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist | findstr "AnyGoW.exe" > "C:\Users\Admin\AppData\Local\Temp\findProcessRes.txt"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:712
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AnyGoW.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

anygo.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-A397U.tmp\anygo.tmp
Size 2.5MB
SHA256 b23d626c65515216d8cbc29412cc92262d6a067ad67322599d67ab1455fde6fd
MD5 ddb4a85b7e5e7eafa981a69f05e1b7c9
SHA1 7f7e070c8b20dc16da7c319a4e4394e905782be4
SHA512 bedd2b13522f2a635f561dfd9d60dfcb6e7151c80062df952064c22a98f28935665f14cf331bbfa3f542e13f31eb8c20b0094749cd6e55d92974e16df1819f3d
SSDEEP 49152:Vg2qPtc1e5OS7bPGoUl+x/grN4azvchYk28X:VvqPCnrN4azvSY0
TLSH
T14AC54A12B285713ED06B2B36493BC65099377E61B9368D1A6BF43D0C8F355802F3BB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3640-16-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-22-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-36-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-10-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/3640-9-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-12-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-14-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-34-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-6-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/3640-18-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-20-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-24-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-26-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-28-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-30-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/3640-32-0x0000000000400000-0x0000000000688000-memory.dmp

Download

memory/5576-0-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/5576-8-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads