938e00fbe6d818bc20fc30a05ff1fdac14c652d77f7b40a653db77c5cc284a16

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aipai_recorder.exe
Size 789KB
Sample261110-wlk2tact7x
SHA256 938e00fbe6d818bc20fc30a05ff1fdac14c652d77f7b40a653db77c5cc284a16
MD5 c5cb3ba57047fbf77549783444130ac8
SHA1 0c70540146fd6e0571b66c101124fa7d6014258f
SHA512 58984f5ff835ef549d34251d163f025d287aaab37fac0ca2b5d14b8203cc6bf928d9ba582fee031ab78c8dea022da7776b87fdfebec255b2f06c49129ddc76f8
SSDEEP 12288:11BWX2WmBme6k/99CEwnN/sNWpXkg/6RzdhKI5H+xrBj+DX9gFUmZHwib0ZAKgWW:5F9anSbg/6prsl+b9pmRwiw1gTD1UDzw
TLSH
T15A0523C72B09C87BD9135AF001F25C9B3BF94D15AE58314207717AA13973A0A7F6EA87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
4504	aipai_recorder.exe
4504	aipai_recorder.exe
4504	aipai_recorder.exe
4504	aipai_recorder.exe
4504	aipai_recorder.exe
4504	aipai_recorder.exe
4504	aipai_recorder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aipai_recorder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aipai_recorder.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aipai_recorder.exe

C:\Users\Admin\AppData\Local\Temp\aipai_recorder.exe
"C:\Users\Admin\AppData\Local\Temp\aipai_recorder.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd240A.tmp\Inetc.dll
Size 766KB
SHA256 f9ef059e032da673eec4098108d83d08dae124a6f8749d99971f92fb85b5f67d
MD5 b1e340a291c7b01170a71d2b9c8a4d87
SHA1 b8ebdbb058bf9286383026b4bbe8ba3936d09ac9
SHA512 64195985994cb6d449a21c76810943e40f6848b312177b88e0cb7ecc69c81d2b8957306d80eb339d4e14a84017f302ddd2ceaee973e1987ba140b2cf7d34cefa
SSDEEP 384:6W9qjPs7naXNUmu2DrwdNqQ/P3pX1r+59NG1W20Ac9khYLMkIX0+GJ0dp5QHq2DL:6WqPs7nadnB3YIQXZ0vNFEMJ0a
TLSH
T165F42980728CDCB3E1A077B59E1D12A2B0C00EC5571E3AE7A2ED564C34EA6E17AF5D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkinBtn.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd240A.tmp\SkinBtn.dll
Size 4KB
SHA256 ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
MD5 e4ec95271ff1bcebab49bdfed6817a22
SHA1 2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA512 771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP 48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
TLSH
T1E691B6BF33C48EF5E056017B1E9319935B9E49715379912F942329866B60DABCA3C703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd240A.tmp\System.dll
Size 11KB
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
TLSH
T162324A1503904AF3F996C13C14263ABF7F792A218BF14E939FA39481BE2D5D96D39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd240A.tmp\UserInfo.dll
Size 4KB
SHA256 0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7
MD5 dada3e1836af78d5b24499da252d01e4
SHA1 d2a1c25405e3c74973cf18dec2c7138df9e96a83
SHA512 f8bda8413dadb00a644341da5e076f203a3134daaefd2961fa0341f5a533eee28582ce9872354ead698bb1275ee7726fa574267e909a3e2f977908392e7a5c66
TLSH
T19A81717B62A80CF3C0940BBB41D71CA71376DC702793011E99470E9A34C4AAFED6E705
MD5 SHA1 SHA512 TLSH

Submit Download

WndProc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd240A.tmp\WndProc.dll
Size 3KB
SHA256 e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
MD5 f0cb331dd4bd92a6ebce45e7cd1cf5ef
SHA1 b66ea0c10b08750295f2dc7c170b370402393214
SHA512 7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
TLSH
T1E951207317E005E2F4142BBD285B6BD7633BC27437A5C3DB816A49072A045EBBCB8756
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd240A.tmp\nsDialogs.dll
Size 9KB
SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
MD5 eac1c3707970fe7c71b2d760c34763fa
SHA1 f275e659ad7798994361f6ccb1481050aba30ff8
SHA512 3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09
SSDEEP 96:oXHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4AqndYHnxss:oXHq+CP3uKrpyREs06YxcdGn
TLSH
T108121A635A4455F3D5D7223A216A2F2FD77C9324A062BC0287779E462BF431A7E3A341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads