24ef9b6d2decb7f5970dd4478a35796517e4322341b27c26eb0543ab656c6776

Analysis

max time kernel
601s
max time network
475s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AACGUARD-v0.0.13-b02.exe
Size 76.6MB
Sample261018-vbpftassbx
SHA256 24ef9b6d2decb7f5970dd4478a35796517e4322341b27c26eb0543ab656c6776
MD5 5bdc55ef01212d25739f4d63d299b25a
SHA1 33fc4f83c322c4fbf74b7259bc748a12a5d13cdf
SHA512 a090a4adb5107641a2fb79ee5b5756c738cbb181ad61942c0869b274aaed6551fc43a519b6f0067e7302f62e90cc4a892230372cdcacf9877e38234ef0755165
SSDEEP 1572864:miaPeH3wzXgXsbY2XFWvFwNhTJzAjAInFLms4twq7JAlw0hsfFCvNbZgymAKBzz7:miaPeXmX6sbYm0mNz+dtwDwmfQvNbZgb
TLSH
T1760833E4C0F18442FCB3CBB58324681317CB562ED97DEB558DBD92832473E93A2A165E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2692	AACGUARD-v0.0.13-b02.exe
2692	AACGUARD-v0.0.13-b02.exe
2692	AACGUARD-v0.0.13-b02.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AACGUARD-v0.0.13-b02.exe

C:\Users\Admin\AppData\Local\Temp\AACGUARD-v0.0.13-b02.exe
"C:\Users\Admin\AppData\Local\Temp\AACGUARD-v0.0.13-b02.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc2F83.tmp\InstallOptions.dll
Size 15KB
SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
MD5 d1eefb07abc2577dfb92eb2e95a975e4
SHA1 0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2
SHA512 eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e
SSDEEP 192:E6GQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT311929WtshLAzgSrX8:E6Nt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T186624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4678565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc2F83.tmp\LangDLL.dll
Size 5KB
SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
MD5 549ee11198143574f4d9953198a09fe8
SHA1 2e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1
SHA512 0fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8
SSDEEP 48:S46+/sTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mWofjLl:z+uPbO5tCZBVEAWyMEFv2Cm9L
TLSH
T1D5C1A370B3D248B9C591413778AB33D36612AE747784504FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc2F83.tmp\ioSpecial.ini
Size 1KB
SHA256 8362b258404666a54f6102d553f2f22422d52aa5628554a043956a0d537e8026
MD5 6388222774ea1c97af31bf7c09d77978
SHA1 5e9f79b2c12e61e32301780b64ad2d3fa19a5712
SHA512 ce6dead9efb8f7c0615be3d2e11c608164848e103b3f7f052828e848e2b88ce1f701d47e8171725df88ab65ed641c44ddd5b29e19620093b536542ba0da7b39e
TLSH
T18B21B3437BFC1204F3BAB754FFF541758B7A78569839C60D81C00A4E09E5B808963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc2F83.tmp\ioSpecial.ini
Size 1KB
SHA256 d663193f078349e2800c369cbbeca1c67e44816c5a9f207f4da0ad8ac507ca10
MD5 d7b946e3abdd4743021d2a5dadd10f12
SHA1 7ec531cd15e53836e558f104daf96e12a42316b0
SHA512 851b1922b7fad92aedbca40e1199ac3ca280baa18995814e2c6646ac4a02232b139e4dcbc6316ce96b239b3db4ee6e0d559ce7e8006dfacd6451a3979c52edb9
TLSH
T12E31E7033AFD0204F3BBB754FFF541798B7978569839C50D90C00A0E05F6A408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads