Overview
overview
10Static
static
3Fix.exe
windows11-ltsc_2024-x64
10$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Aether.exe
windows11-ltsc_2024-x64
6LICENSES.c...m.html
windows11-ltsc_2024-x64
3d3dcompiler_47.dll
windows11-ltsc_2024-x64
1ffmpeg.dll
windows11-ltsc_2024-x64
1libEGL.dll
windows11-ltsc_2024-x64
1libGLESv2.dll
windows11-ltsc_2024-x64
1resources/app.js
windows11-ltsc_2024-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3vk_swiftshader.dll
windows11-ltsc_2024-x64
1vulkan-1.dll
windows11-ltsc_2024-x64
1$PLUGINSDI...7z.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 17:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Fix.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Aether.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
d3dcompiler_47.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
ffmpeg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
libEGL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
libGLESv2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
resources/app.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
vk_swiftshader.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
vulkan-1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Aether.exe
- Size 168.6MB
- Sample261002-vwhtrsfa44
- SHA256 9a3cc6307edc386b7d7f4d000c121a1ec4651b65eb6bf016b448158acab78c17
- MD5 4b31d114c1060b758f7b7aff73a92afa
- SHA1 06ee4c2f42a2a8de29257edf8b998d53a8887ee6
- SHA512 c670972f80ed1c3becc97944801d4475904dfdecbdf7db58f9287606b445ecdcdcb6efdcb086711b3e5a9126306aa376775fc9ee1b88d88ffb857a1472a249a4
- SSDEEP 1572864:IOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:KgmeNxNNZxqV
- TLSH T15B887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
pid Process 5900 WMIC.exe - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 2932 WMIC.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6008 cmd.exe 5020 cmd.exe 2952 cmd.exe 3892 cmd.exe 5096 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Aether.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Aether.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Aether.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Aether.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz Aether.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 Aether.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Aether.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz Aether.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Aether.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Aether.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString Aether.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Aether.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz Aether.exe - Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 3048 WMIC.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1688 WMIC.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3048 WMIC.exe 3048 WMIC.exe 3048 WMIC.exe 3048 WMIC.exe 1688 WMIC.exe 1688 WMIC.exe 1688 WMIC.exe 1688 WMIC.exe 5900 WMIC.exe 5900 WMIC.exe 5900 WMIC.exe 5900 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5796 Aether.exe Token: SeCreatePagefilePrivilege 5796 Aether.exe Token: SeIncreaseQuotaPrivilege 3048 WMIC.exe Token: SeSecurityPrivilege 3048 WMIC.exe Token: SeTakeOwnershipPrivilege 3048 WMIC.exe Token: SeLoadDriverPrivilege 3048 WMIC.exe Token: SeSystemProfilePrivilege 3048 WMIC.exe Token: SeSystemtimePrivilege 3048 WMIC.exe Token: SeProfSingleProcessPrivilege 3048 WMIC.exe Token: SeIncBasePriorityPrivilege 3048 WMIC.exe Token: SeCreatePagefilePrivilege 3048 WMIC.exe Token: SeBackupPrivilege 3048 WMIC.exe Token: SeRestorePrivilege 3048 WMIC.exe Token: SeShutdownPrivilege 3048 WMIC.exe Token: SeDebugPrivilege 3048 WMIC.exe Token: SeSystemEnvironmentPrivilege 3048 WMIC.exe Token: SeRemoteShutdownPrivilege 3048 WMIC.exe Token: SeUndockPrivilege 3048 WMIC.exe Token: SeManageVolumePrivilege 3048 WMIC.exe Token: 33 3048 WMIC.exe Token: 34 3048 WMIC.exe Token: 35 3048 WMIC.exe Token: 36 3048 WMIC.exe Token: SeIncreaseQuotaPrivilege 3048 WMIC.exe Token: SeSecurityPrivilege 3048 WMIC.exe Token: SeTakeOwnershipPrivilege 3048 WMIC.exe Token: SeLoadDriverPrivilege 3048 WMIC.exe Token: SeSystemProfilePrivilege 3048 WMIC.exe Token: SeSystemtimePrivilege 3048 WMIC.exe Token: SeProfSingleProcessPrivilege 3048 WMIC.exe Token: SeIncBasePriorityPrivilege 3048 WMIC.exe Token: SeCreatePagefilePrivilege 3048 WMIC.exe Token: SeBackupPrivilege 3048 WMIC.exe Token: SeRestorePrivilege 3048 WMIC.exe Token: SeShutdownPrivilege 3048 WMIC.exe Token: SeDebugPrivilege 3048 WMIC.exe Token: SeSystemEnvironmentPrivilege 3048 WMIC.exe Token: SeRemoteShutdownPrivilege 3048 WMIC.exe Token: SeUndockPrivilege 3048 WMIC.exe Token: SeManageVolumePrivilege 3048 WMIC.exe Token: 33 3048 WMIC.exe Token: 34 3048 WMIC.exe Token: 35 3048 WMIC.exe Token: 36 3048 WMIC.exe Token: SeIncreaseQuotaPrivilege 1688 WMIC.exe Token: SeSecurityPrivilege 1688 WMIC.exe Token: SeTakeOwnershipPrivilege 1688 WMIC.exe Token: SeLoadDriverPrivilege 1688 WMIC.exe Token: SeSystemProfilePrivilege 1688 WMIC.exe Token: SeSystemtimePrivilege 1688 WMIC.exe Token: SeProfSingleProcessPrivilege 1688 WMIC.exe Token: SeIncBasePriorityPrivilege 1688 WMIC.exe Token: SeCreatePagefilePrivilege 1688 WMIC.exe Token: SeBackupPrivilege 1688 WMIC.exe Token: SeRestorePrivilege 1688 WMIC.exe Token: SeShutdownPrivilege 1688 WMIC.exe Token: SeDebugPrivilege 1688 WMIC.exe Token: SeSystemEnvironmentPrivilege 1688 WMIC.exe Token: SeRemoteShutdownPrivilege 1688 WMIC.exe Token: SeUndockPrivilege 1688 WMIC.exe Token: SeManageVolumePrivilege 1688 WMIC.exe Token: 33 1688 WMIC.exe Token: 34 1688 WMIC.exe Token: 35 1688 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5796 Aether.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 5796 wrote to memory of 2864 5796 Aether.exe 89 PID 5796 wrote to memory of 2864 5796 Aether.exe 89 PID 5796 wrote to memory of 2716 5796 Aether.exe 90 PID 5796 wrote to memory of 6008 5796 Aether.exe 91 PID 6008 wrote to memory of 3380 6008 cmd.exe 93 PID 3380 wrote to memory of 2272 3380 net.exe 94 PID 5796 wrote to memory of 5020 5796 Aether.exe 95 PID 5020 wrote to memory of 3048 5020 cmd.exe 97 PID 5796 wrote to memory of 2952 5796 Aether.exe 99 PID 2952 wrote to memory of 1688 2952 cmd.exe 101 PID 5796 wrote to memory of 3892 5796 Aether.exe 102 PID 3892 wrote to memory of 5900 3892 cmd.exe 104 PID 5796 wrote to memory of 5096 5796 Aether.exe 105 PID 5096 wrote to memory of 2932 5096 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aether.exe"C:\Users\Admin\AppData\Local\Temp\Aether.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\Aether.exe"C:\Users\Admin\AppData\Local\Temp\Aether.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\aether" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1640 --field-trial-handle=1644,i,15576668160550070741,1646672342004337791,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:22⤵PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\Aether.exe"C:\Users\Admin\AppData\Local\Temp\Aether.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\aether" --mojo-platform-channel-handle=2284 --field-trial-handle=1644,i,15576668160550070741,1646672342004337791,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:82⤵
- Reads the TCP/IP host and domain name from the registry
PID:2716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:2272
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get size /value3⤵
- Reads the TCP/IP host and domain name from the registry
- Collects information from the system
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer,product /value3⤵
- Uses WMI to collect hardware manufacturer information
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber,version /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber,version /value3⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2932
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Windows Management Instrumentation
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\aether\Code Cache\wasm\index-dir\temp-index
- Size 48B
- SHA256 ea65416f299e468adc3da65dd38e953cf3dd3698fd11200b415e3789dda0d6db
- MD5 58eb2b8f8066461378f0bc06b83428ae
- SHA1 9aab897ccdee85963d1e5697a1e41018953d8626
- SHA512 ce1ec749461ad9535f3933b4e5413fa9229ca4ae6e59916dd18c8e4dd974bbd35721805011e8d939f0a331a98d6b1fab12b986858030d3129cabe5660433a183
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\aether\Local Storage\leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512