aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 09:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2.exe
Size 1.6MB
Sample260924-lgp5vsae52
SHA256 aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2
MD5 383c15c1b82b15ad87a1e473a9cb2c12
SHA1 ebd42d757031f8177f06785c38ff3bd166e8990a
SHA512 63a840040a28a75bcf404506e2b034a47cc2496c7f4c9367d4d42970f543318682c7b3bcbf5971edd25fa0c3ca4d8d957ff6d78c02e09cfe2c4483e20f013d1a
SSDEEP 49152:MSMiCK8Ug8b32ZynV4oDabuWbDQOcIxJJf5:BMiCKg8L8+RDabpd5
TLSH
T1527512527B2180F1C49716719D61E73DF77056018B78CDD3E7C8AEA05CA36A63A3B38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2408	1A0C0D0F120D156F155B15D0C0B160C0E160F.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4128	aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2.exe
2408	1A0C0D0F120D156F155B15D0C0B160C0E160F.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1A0C0D0F120D156F155B15D0C0B160C0E160F.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2408	4128	aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2.exe	90

C:\Users\Admin\AppData\Local\Temp\aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2.exe
"C:\Users\Admin\AppData\Local\Temp\aaaffe59d2c22a8a51e89241b9067163c2efc2da44d88cd23611fd7df8a160e2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\1A0C0D0F120D156F155B15D0C0B160C0E160F.exe
  C:\Users\Admin\AppData\Local\Temp\1A0C0D0F120D156F155B15D0C0B160C0E160F.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1A0C0D0F120D156F155B15D0C0B160C0E160F.exe

Path C:\Users\Admin\AppData\Local\Temp\1A0C0D0F120D156F155B15D0C0B160C0E160F.exe
Size 1.6MB
SHA256 1ea5ba9b4a473ab34da458e0acb11d0b6c315cf8a5b5e5d9c5f7b7d9d98b96dd
MD5 4c74c4b3073e8ffe6ddf73ff4a45db0d
SHA1 41703078a48c028287e26d96250f9df94bdef776
SHA512 bea353b0a677bc9bf8fcea1204408f0b03600591c210f7810ac2cba380b25868467110c4c9bcc4d87575f59d7c9423cd7ccb11fc728d919b747bb54baa04c4de
SSDEEP 49152:8SMiCK8Ug8b32ZynV4oDabuWbDQOcIxJJf5:RMiCKg8L8+RDabpd5
TLSH
T1CB7512527B2180F1C49716719D61E73DF77056018B78CDD3E7C8AEA05CA36A63A3B38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2408-10-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/2408-11-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/2408-7-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4128-1-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4128-9-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads