1ca90bd54842725e39e577f72e0547f469613899c4acbef528bdfa0782955200

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
Size 196KB
Sample261009-tl2cpacb45
SHA256 1ca90bd54842725e39e577f72e0547f469613899c4acbef528bdfa0782955200
MD5 fb7526f3cb7067c02c9d999a633e0ef0
SHA1 f66996723396da44ceed340226f2d0b66a6c6f4a
SHA512 bb27076bf9bcc824a83ecc2d9e2425810560354298e36750e705f55f75510d4384943770ee1d13ba784aefc1632f71d5baf3ca1836baff45f951d6fede8ab12a
SSDEEP 3072:y5YGQVtJfoELnE2LmfPZTLCBhm2TsuZfc:jVji3Z3Cq2wuZE
TLSH
T1DD14F3D563CDA9E9CCF8D3BD817E8BA13013D7271F8A06D27E888532692C9357AB4354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5604	qdchkz.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qdchkz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4864	PING.EXE

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\haypr	qdchkz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	qdchkz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	qdchkz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	qdchkz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\haypr\\command	qdchkz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	qdchkz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\haypr	qdchkz.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4864	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 2980	5776	jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe	89
PID 2980 wrote to memory of 5604	2980	cmd.exe	91
PID 2980 wrote to memory of 4864	2980	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\wyxgdgw.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\qdchkz.exe
    "C:\Users\Admin\AppData\Local\Temp\qdchkz.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5604
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qdchkz.exe

Path C:\Users\Admin\AppData\Local\Temp\qdchkz.exe
Size 148KB
SHA256 6bb2dcb707f4e958f9d78147b3576b8d6ba9c8175709f60f56e826aef4dd81db
MD5 a8d1866171bb882dc83da33e64a7ba24
SHA1 39dd3e7469366f6ee45bf3366dfb798a3710e9b4
SHA512 70314a664ef2d458c9fa29bb2ae706a3f24897f7f2f048e1cf8c16ef37c75e1f7128a57a3475658c4e6257db4234fbc1438034f5f7241743c62c9d8cc7f57b12
SSDEEP 1536:nHDZDYG5WGbctJuhFCovMLqPpWvE2mHQjLP+fhVZTLQ3h7FhmKijl:n5YGQVtJfoELnE2LmfPZTLCBhmP
TLSH
T141E39DE563CDA6E9CCF9E3BD81BD8BA13053D36B1F8A02D27E888131691897576F4344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyxgdgw.bat

Path C:\Users\Admin\AppData\Local\Temp\wyxgdgw.bat
Size 124B
SHA256 6625abcf08300c6a90959dfd3cbca7d44a5cf93a590ddc5fafd95130c6080ac3
MD5 7c5fcc7c68007e6a0415e989b50e8153
SHA1 41dfcfee0a97ce1ed7479b899ceccce5282bae90
SHA512 bc23e37e699f2af0944f83709453c55f433afed141b1eb03d07793931dd4651992fca1ba6d06a7f62ab5370b9a7adf226998ded7f178d0637d0eb38b36e7cd27
TLSH
T144B0920285E7DB695848E0A74769A78EC0B88D582A763B218B14C80C3966C2EA586329
MD5 SHA1 SHA512 TLSH

Submit Download

ymqqrn.bat

Path C:\Users\Admin\AppData\Local\Temp\ymqqrn.bat
Size 167B
SHA256 076b7dbf4bfbd7390fecffa9a7617ec7d388cb43cb036aac9733fef71c3b93fc
MD5 9b00c946975f136f12b37627e66d60c4
SHA1 fe67b43053afa106e5296e8ede9bc3ebe6931144
SHA512 4acad61c4a9acf37783a602c7a175d9938b9467bc72ccbca102f865fb57e47f2972893a4af49c2b87872923589557dcf62a4eca27cdea61161225b183d6c6e58
TLSH
T1F2C08C9A8283C66D0A08C4A70838A74FE46A0C4C3A8D3B005B31F9CC22E6819BA87704
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads