82edf16bb84dfb0f0fd0b90770ccc0c81b07d588961cca5ce4a3e01d6944a11d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
Size 292KB
Sample261009-tlxdqsbt21
SHA256 82edf16bb84dfb0f0fd0b90770ccc0c81b07d588961cca5ce4a3e01d6944a11d
MD5 2ea19ed1fdfb01d184cc5b28d2b865a4
SHA1 dc905186bf3ef654781aa542bec206621bf6d9e3
SHA512 c677dce21aeed4eee49381e1d157ecef126b6c51fbe833be1a6402f13cc1038aba873038914b9f4dc8559d6e8bc4cf3407956d38b702c2a79879361a25f62f66
SSDEEP 6144:nIRMHr+a5EMa4eeEHt5rMD5j55tEML/ZVaaz+VQF55555555555555555555555q:nfHr+aSXnHYftwCS
TLSH
T1495469CEAEF19064D88000B9CDF2AE7A1C2D3CFF75F791525A10D515FA6C1A2EB29C64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1584	eqromu.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eqromu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2996	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2996	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 5068	2180	jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe	89
PID 5068 wrote to memory of 1584	5068	cmd.exe	91
PID 5068 wrote to memory of 2996	5068	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Koutodoor.aihc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dxupcqt.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Users\Admin\AppData\Local\Temp\eqromu.exe
    "C:\Users\Admin\AppData\Local\Temp\eqromu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1584
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aojsct.bat

Path C:\Users\Admin\AppData\Local\Temp\aojsct.bat
Size 167B
SHA256 ba3e5b2e5469c14080afb8232906022bef14a458bdff2edda4c61610c3da91ab
MD5 570bd48c9a44949f55cb7141b00cd31d
SHA1 c7ca3b81da1eb4bc1a987547676450fe6deead54
SHA512 337dbbe33b98de47bdde14ece2800856d2bdf86d4995534065142066191f0a92fc5fc9a626ecf3d4a2946996c7e362450b8fcf758b803d024c34365ff0b5715d
TLSH
T1B6C08C4E8283867D0A08C4A70878774FE46A0C5C3A493B005B3AE9C922E2419AB87704
MD5 SHA1 SHA512 TLSH

Submit Download

dxupcqt.bat

Path C:\Users\Admin\AppData\Local\Temp\dxupcqt.bat
Size 124B
SHA256 4f5c7dd62314e314845bdd74b4612d7f6e87937ac9bc39cf46a5a3eec0f5101b
MD5 a93a22bdfeae74066be32889f11300eb
SHA1 aefb2ba175bf4d0ce48a6630662e6952ebeb1f3b
SHA512 fb2d2399a05bf2bd6f9a5e96cd8ecccfe2a711f64c3d31e29da195c3b97a262769eccb680ec976ce6da2482e8547c8e7bfaab093b05892f14338565e9e1f8747
TLSH
T1B8B09B0E55D6965D141DD1271567924C906C8C582A993715D710C80F1555C1DB58335D
MD5 SHA1 SHA512 TLSH

Submit Download

eqromu.exe

Path C:\Users\Admin\AppData\Local\Temp\eqromu.exe
Size 188KB
SHA256 e2fd3e7413b2658a385e03c96e32cd619c681b098a3e9e00f56e86dae10e3801
MD5 96b83e85bb008161aebb39f5673f2d1a
SHA1 3b3955bd5ac38d5ede083c3c8e373eb3fbde1822
SHA512 853cf819510740596ecd6156feec963d0785bdac6e921829f484ac86f2e195f657e9f45aaa923e143194a0436ca51cbd33ff5d872c815e0da5db8a65c1b12f3c
SSDEEP 3072:yg1nLTAgCh1a5Ewna4ewZ3XdaHt5rMD5j55tEML/ZVaxIzDAfeIwuBIicOI7F55z:3+a5EMa4eeEHt5rMD5j55tEML/ZVaazF
TLSH
T1EC1459CE8DF19164E89100B9CEF2AE7A6C1C3CFF75FB61515A10D414FA6C162EBA9C84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads