Analysis
- user interaction
yes - max time kernel
59s - max time network
63s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 10:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aegis_crackme.bydenizloki.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
aegis_crackme.bydenizloki.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target aegis_crackme.bydenizloki.exe
- Size 55.9MB
- Sample260910-mz9snavyds
- SHA256 e576f87f65fb5858650b919c99b8a7ac81b12eca693a040f3671dc66c67ce18b
- MD5 b0326ed717108831f5c3971847671ef5
- SHA1 61ed9233e7fc974b660a0952451a72635dc47448
- SHA512 19a5f370e361fc5f58b74b898075aeef8427c3d4293a5584949d86711763b00762ed8b4f61fb4143fc48f02bd0d48ec5f98a0e46c2a3adc819414c8b1924ea09
- SSDEEP 1572864:LKeztU3TQGZaFMJBHf+DrZwfFpUWwkwPMveFcKzQO:LKeoQGKMX/+DCfLlwEvQ
- TLSH T144D712C768E181ACC892C534E28A1BFEE4CDF8894CB9592FBFC748023531D55D8EA675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3552 aegis_crackme.bydenizloki.exe 3552 aegis_crackme.bydenizloki.exe 3552 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3552 aegis_crackme.bydenizloki.exe 3552 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe 4992 aegis_crackme.bydenizloki.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3552 aegis_crackme.bydenizloki.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3552 aegis_crackme.bydenizloki.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3552 wrote to memory of 4992 3552 aegis_crackme.bydenizloki.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\aegis_crackme.bydenizloki.exe"C:\Users\Admin\AppData\Local\Temp\aegis_crackme.bydenizloki.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\aegis_crackme.bydenizloki.exe"C:\Users\Admin\AppData\Local\Temp\aegis_crackme.bydenizloki.exe" --guard 35522⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4992
-