2552f712e196e96e3dd20cc2f957edb5b338887cc426e4e0bec83237c25a10f9

Analysis

max time kernel
194s
max time network
170s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
airat7.exe
Size 566KB
Sample261110-lehm1aec69
SHA256 2552f712e196e96e3dd20cc2f957edb5b338887cc426e4e0bec83237c25a10f9
MD5 af891ef9656fd905d4b7672ec989a560
SHA1 44910deec8485634d157b77dd2f2884b8d5a0a78
SHA512 f556ac6f9c3b380c720079747ab17195a26184abc7338debb4777b1c7ea994167f98d081c63b6d43e753e93a21d81186ad6fd2373732ff433eabc770c7c6f94c
SSDEEP 6144:5UkHe6vqlZPZUNF4OSspwIl2a3MEeP0BHUWq+9yN86IpKIGlAvZq2qB9S99NpNNm:KEfSspwu2a8EGIQFPSHz7rpEz
TLSH
T1ADC4188336C71CFAD9936B3C90DB533A6734FDA04B6B4B278918D2320D235D1AE5AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	airat7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	airat7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4240	airat7.exe
4240	airat7.exe

C:\Users\Admin\AppData\Local\Temp\airat7.exe
"C:\Users\Admin\AppData\Local\Temp\airat7.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.log

Path C:\loader.log
Size 135B
SHA256 790f51d09ec7a0a3a19b1c9207e150d3480e950be0d02efa77a0dc1e697a7387
MD5 fd84c38c6fcdb473e101244b0ac184b8
SHA1 bdd505744016998c7d4fad0ce94de847e3d67514
SHA512 abdbddf6663a12f1ac928421fe9c29a2c20fee4b2e4c4ced7344873f211b70fde129ad280c160ac5d6463de9b1967c92d54de8fbe30785c42a5398b348a45d70
TLSH
T127C09B4110C04147690475C1E557D325113C47DADFAC0163871A17C670FD7356E0533B
MD5 SHA1 SHA512 TLSH

Submit Download

loader.log

Path C:\loader.log
Size 1KB
SHA256 ff2dd4e83447a3525b0bfdf86eab36b81d3d703f86afb3ab7b2d67579c5df506
MD5 9dd2678f0e816441dbaaab2b076bbd13
SHA1 7ecc7620c85b6feb04fdea5f22a2822b4cf0b6d5
SHA512 24830eca1f275e7ab3459a7d256d105780b56cb8b8ba18b8e400b5bda37a2d102833b3bdc006872058cd72c7eac0c4c4474bf40dff5ca1f7d8c731553a7a07c1
TLSH
T1BD3169F08CC46043F60EADC9F6067A5482337AA6CBF0A5594A59D7604E33ED32C6F963
MD5 SHA1 SHA512 TLSH

Submit Download

loader.log

Path C:\loader.log
Size 1KB
SHA256 8a2b0d6eb536ae534d55bba837fd91ee2efde24cfd5bdac360241351c586073b
MD5 e77ec56147512eed5ba90e0877828369
SHA1 ee4c8c87c683da04a1824ed14b917bc1b703a42d
SHA512 c9e00f74cf5e717f13419c5a5534181caecdf0ea54340513dbcb2fe3beab861b752d091d72e6183d34465635ca57dd03111a8d8245ff3d0e7cc29b678d690a3d
TLSH
T12E3176F08CC52043F54EA9C9F6067A1483337AA68BF4B5194A59D3608933FD32C6F923
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4240-38-0x00007FF737990000-0x00007FF7379F2000-memory.dmp

Download

memory/4240-46-0x00007FF737990000-0x00007FF7379F2000-memory.dmp

Download