82edf16bb84dfb0f0fd0b90770ccc0c81b07d588961cca5ce4a3e01d6944a11d

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
Size 292KB
Sample261009-tlxdqsbt21
SHA256 82edf16bb84dfb0f0fd0b90770ccc0c81b07d588961cca5ce4a3e01d6944a11d
MD5 2ea19ed1fdfb01d184cc5b28d2b865a4
SHA1 dc905186bf3ef654781aa542bec206621bf6d9e3
SHA512 c677dce21aeed4eee49381e1d157ecef126b6c51fbe833be1a6402f13cc1038aba873038914b9f4dc8559d6e8bc4cf3407956d38b702c2a79879361a25f62f66
SSDEEP 6144:nIRMHr+a5EMa4eeEHt5rMD5j55tEML/ZVaaz+VQF55555555555555555555555q:nfHr+aSXnHYftwCS
TLSH
T1495469CEAEF19064D88000B9CDF2AE7A1C2D3CFF75F791525A10D515FA6C1A2EB29C64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
840	gitahl.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4292	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gitahl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3872	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3872	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5928 wrote to memory of 4292	5928	jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe	86
PID 4292 wrote to memory of 840	4292	cmd.exe	88
PID 4292 wrote to memory of 3872	4292	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\oxabzuz.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Users\Admin\AppData\Local\Temp\gitahl.exe
    "C:\Users\Admin\AppData\Local\Temp\gitahl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:840
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gitahl.exe

Path C:\Users\Admin\AppData\Local\Temp\gitahl.exe
Size 188KB
SHA256 93f200749bb2748f6c05cec3d2b7ad96dae6d1879effaab7bdf519844da6e120
MD5 cedc8254a6bd9fdd15598728ede2b6ca
SHA1 5982b195d8ae2cdc16c632b861ebb077089aab27
SHA512 887cd751eca1b36b1b81533c4d9664d5193fe3f0f60ebbe344e176bee57af6844b51c24ff0a74fcb61fdf1154ed5f4955ecd4d4c5792de86cf283ada497e0b46
SSDEEP 3072:yg1nLTAgCh1a5Ewna4ewZ3XdaHt5rMD5j55tEML/ZVaxIzDAfeIwuBIicOI7F55H:3+a5EMa4eeEHt5rMD5j55tEML/ZVaaz5
TLSH
T1A31459CE8DF19164E89100B9CEF2AE7A6C1C3CFF75FB61515A10D414FA6C162EBA9C84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nzlyby.bat

Path C:\Users\Admin\AppData\Local\Temp\nzlyby.bat
Size 167B
SHA256 8bc089212de4f135e1634f473f71def242584da77269e0dfed80dbe434a4ba01
MD5 81073eb3be0e3b2db0036e10efcb2c15
SHA1 dd31a558591563aae7fa91087f84b28f224112fe
SHA512 103cb1b5ce25a99bc0d12e6c5ce3181eac07fdc2609134c7d73432febdce852ef83d08b72555e75249fea177f57e4db00779e4ca8ade90dc8509d59a4a698c0c
TLSH
T1D2C08C4A8283966D0A09D5A70839674FE0AA0C5C3B493B009B35E9C822E241DAA87704
MD5 SHA1 SHA512 TLSH

Submit Download

oxabzuz.bat

Path C:\Users\Admin\AppData\Local\Temp\oxabzuz.bat
Size 124B
SHA256 e03f12027420a77903198c5dff2360e6d318004c8c4ce5f488ac7f8ff476095f
MD5 a42ad797ed2dce5b701825fd7efa5150
SHA1 36351799eed3da70c1badb5852a14b9f1b399557
SHA512 e79e8d2d5ad43fa3abad1e8c9698c9c320a467190000736d2004ca879324269f5987b6b550e879d924fe53739e040bdeabd915eb6fd9b056134ae04b09f4402b
TLSH
T143B0920256D797691808E467066A928CA27C8C5A3AA57F11CB20CE0C2D96C7DADC2311
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads