c6560abf01b93cb8fb8b5c02b8b1eee224133729d2a387fd551c8514acf2dad5

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/payload/AOTools.exe
Size 21.2MB
Sample261006-pg3bzagt4w
SHA256 c6560abf01b93cb8fb8b5c02b8b1eee224133729d2a387fd551c8514acf2dad5
MD5 cec6d47f7410810241cb46ebfa0192e4
SHA1 c892c2942d337b5581b248f2f27d629bb88c18d8
SHA512 26f7ebcde998a70161e26e59c55c67a49a26d2e703fb5c3e29c4cf98663d7b3934ecb2798a65ae7a44a9cfa958a4855396de425d7ab971ec06d190d071e3c8fb
SSDEEP 393216:q1UZmMIiA3GH21iLd0IA5Kz+e/WETqYRE+:GUsMaWO4mImgB/WhYW+
TLSH
T1B427C07BF3D12277EDE3037A564D44F1ED3C7119932450EA98AD96383686A3E927023E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4576	AoG-Storage-Native-Scanner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AOTools.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AOTools.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4576	1380	AOTools.exe	89

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\AOTools.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\AOTools.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\AoG-Storage-Native-Scanner.exe
  "C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\AoG-Storage-Native-Scanner.exe"
  2⤵
  - Executes dropped EXE
  PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AoG-Storage-Native-Scanner.exe

Path C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\AoG-Storage-Native-Scanner.exe
Size 1.0MB
SHA256 f26806fa734940437aeef5878748e7011312114667dd89dee24379a7379af394
MD5 75be991ebcf30cdf2c9325cc736fdfea
SHA1 fada302f6085a87ae8e7f82564936783ca3b06e6
SHA512 42c7507dda3174f5654129ca608de477c4ebfba5a0b14fa2387c9164c39f774f445ae36c4542a69b480c3c7a584d7bb2ae5abe7bdea8762f85f81be868edaeae
SSDEEP 24576:wkT4F7XVZlNbsC7VDZe+qAGPf7HK939uacKD:CHlND7VZqAGPfDm3MC
TLSH
T1D8257C5722B1D2F8C86AC03852579552DE35B88D0324BCEF06E217702D9BEF64F7A62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

item_catalogue.tsv

Path C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\item_catalogue.tsv
Size 916KB
SHA256 54b4ca09e40e3870e1bea3c86659184eb416244a69c37603d7b62fb6768ffc56
MD5 5b30f2eee437479ddf6d10f7a82d24a6
SHA1 072f2dfaf5cc766665ad6e2597d28fb7a632ddeb
SHA512 64656079a98b34d7213e21135981828835b4df9c7766692eeb348fedbe565a8cf70bc9029e8e24ca2f73a5360a771e750a373ba7af29535514d27f6d5a25bb16
SSDEEP 12288:XbpUifFP21mge0gUSr4xGosZuRG69j10wy:r+ej4xGosZuRG/wy
TLSH
T18B156DEEEAD5227341DB05D969CE2EE9243C0513C34265358C2DD2AD36CB67FE270A39
MD5 SHA1 SHA512 SSDEEP TLSH