20d383302af1a3c21ef3184dddd0d58f0d85fdf7a48fdf9bdeae9368b9873bad

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:18

Target
$PLUGINSDIR/payload/AoG-Tools.exe
Size 396KB
Sample261006-pg3bzagt4w
SHA256 20d383302af1a3c21ef3184dddd0d58f0d85fdf7a48fdf9bdeae9368b9873bad
MD5 c6f8d3f763f38c22d1646d72436d199c
SHA1 7d99eeaba405176e0cd2acc626c41392da5a6e4e
SHA512 0b6ad6bb2aed58fc4ea074744107cc435cf55d7c409033390896127256cb886b0edbe54378db450529ecf6145db03b7b2be0de41bdb5f28ba51ba3ed1108dfbb
SSDEEP 6144:LEWSMLuZcMZyq2CbXlXy3IX+Z26Tv1YLAxmWtmp7tJLpT6LqkrhZuAVv9RbqjPLf:R9Lu+wV7q+rp7fJVk7enGK
TLSH
T164847D87E0A195F8D897D03C534BE05199327C5C0350D8EF13966B702EABED29F7BA29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1300	AoG-Storage-Native-Scanner.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 5804	4704	AoG-Tools.exe	90
PID 5804 wrote to memory of 1300	5804	AOTools.exe	91

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\AoG-Tools.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\AoG-Tools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\AOTools.exe
  "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\payload\AOTools.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\AoG-Storage-Native-Scanner.exe
    "C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\AoG-Storage-Native-Scanner.exe"
    3⤵
    - Executes dropped EXE
    PID:1300

AoG-Storage-Native-Scanner.exe

Path C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\AoG-Storage-Native-Scanner.exe
Size 1.0MB
SHA256 f26806fa734940437aeef5878748e7011312114667dd89dee24379a7379af394
MD5 75be991ebcf30cdf2c9325cc736fdfea
SHA1 fada302f6085a87ae8e7f82564936783ca3b06e6
SHA512 42c7507dda3174f5654129ca608de477c4ebfba5a0b14fa2387c9164c39f774f445ae36c4542a69b480c3c7a584d7bb2ae5abe7bdea8762f85f81be868edaeae
SSDEEP 24576:wkT4F7XVZlNbsC7VDZe+qAGPf7HK939uacKD:CHlND7VZqAGPfDm3MC
TLSH
T1D8257C5722B1D2F8C86AC03852579552DE35B88D0324BCEF06E217702D9BEF64F7A62D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

item_catalogue.tsv

Path C:\Users\Admin\AppData\Local\AoGTools-Storage\bin-1.0.1.263\item_catalogue.tsv
Size 916KB
SHA256 54b4ca09e40e3870e1bea3c86659184eb416244a69c37603d7b62fb6768ffc56
MD5 5b30f2eee437479ddf6d10f7a82d24a6
SHA1 072f2dfaf5cc766665ad6e2597d28fb7a632ddeb
SHA512 64656079a98b34d7213e21135981828835b4df9c7766692eeb348fedbe565a8cf70bc9029e8e24ca2f73a5360a771e750a373ba7af29535514d27f6d5a25bb16
SSDEEP 12288:XbpUifFP21mge0gUSr4xGosZuRG69j10wy:r+ej4xGosZuRG/wy
TLSH
T18B156DEEEAD5227341DB05D969CE2EE9243C0513C34265358C2DD2AD36CB67FE270A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download