ae04803a33b56ac33589b06e56f4b48e67d62b7942bc07ac4cb3382b191ce012

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nztool_oar.exe
Size 7.0MB
Sample261026-2rf8psgz81
SHA256 ae04803a33b56ac33589b06e56f4b48e67d62b7942bc07ac4cb3382b191ce012
MD5 c31fbc506c9c81b2bd17e7286517dcf9
SHA1 3c2e7cdeba4d6adde355ead84882ea69a8f9387d
SHA512 c98b8baf179a37ce10bc71323b6573643d82670296765004959fd4ea247db2d00d8fd09df97288f13427d915f4bf1c3aec40d28020ed079419d2fbb8e663ee6c
SSDEEP 98304:n6wz1nGapLBUis5h7pJgBpHwB5xrMs5vdbZ+o2:n75g/gfHwGAk
TLSH
T1DD768C03F35291EDC12AC0B59346A233FA72B849073576EB5BD45B312E62BD05B3DB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nztool_oar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nztool_oar.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4504	nztool_oar.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4504	nztool_oar.exe
4504	nztool_oar.exe
4504	nztool_oar.exe
4504	nztool_oar.exe

C:\Users\Admin\AppData\Local\Temp\nztool_oar.exe
"C:\Users\Admin\AppData\Local\Temp\nztool_oar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads