Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/11/2026, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acae2c72ff42fa04.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
General
- Target acae2c72ff42fa04.exe
- Size 12.8MB
- Sample261113-as7cqsys8m
- SHA256 acae2c72ff42fa04906508bb14087b8934b39abfafdc40c08f2a836c29bf67ce
- MD5 37c3f5748377ce1fadecb2fbf08994af
- SHA1 40cf01b767a5f181ff5d64f60ddb9a6d58332c67
- SHA512 d3b6599d92bf8f5c9a461ab6915d60e2b4aae5b367999b444408183f19080235a0a47ee2f7aca0b4577da6d0e2e07db4be0d62049125f730e2d3a1f293a6e352
- SSDEEP 393216:WrUCtDQXQqEW4xXMKkpsMTL2Jyk6kvyP:PtXsW4xXuptTLvkv6P
- TLSH T116D633A59A511C97DAA91B34D2F623A64B11FD431F61C7F33082E43D28232DCB875B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation gomoku-server.exe - Executes dropped EXE 1 IoCs
pid Process 1968 gomoku-server.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" acae2c72ff42fa04.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1968 4920 acae2c72ff42fa04.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\acae2c72ff42fa04.exe"C:\Users\Admin\AppData\Local\Temp\acae2c72ff42fa04.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gomoku-server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gomoku-server.exe2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1968
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gomoku-ai.exe
- Size 176KB
- SHA256 096e5b51b55d966f3cf6bdab991ad2063e5737487ed05162e9d06c7782ccaced
- MD5 cb764ff360c2dfef4ff1e0374b69b110
- SHA1 29bc942310d65f885c421062f14267712283e9bb
- SHA512 45d07f19221dd5b6f0be1cc0c9fa062c2bfa304872b1d4853b86f9a2e48e8105fcf9ab44e97da08666c8e69e12196c07db4403f9ce7827eb5f99e62e848b79ee
- SSDEEP 3072:HREBba0i3Vy6EWB7oZ+JviKToZYAqyEHzHsf3Z5can+3MKY46:KBbaQ61GY6io6yiLY46
- TLSH T1B1042A9672E61CEEDA16837C85D69322B378B4A043635F1B5624F6301F13FC07E9B629
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gomoku-server.exe
- Size 45.7MB
- SHA256 b19ba072bb22a7e5f73b9c1e64944aabc2154b63d0127ed0ba28d8dabfe29ba4
- MD5 d4abb93f1620642b6e679d067ee0c1ed
- SHA1 8d4d825b72332ab3078386c947d50923112faa55
- SHA512 23d65195da310ca013ac708317e6da817304ce21b4365a1e1c35f2d129f4c921668288a21aac9fa334231a0b5a13f3a0db10842fee50cbfff8b24e55956adcd6
- SSDEEP 393216:M6F3TI9E/wpw2/pblsj7KfEfJInv3lMz5/oZxGsnxylfyYr8BUkpcI4KXr3/hIxV:M9HlkOm6RXdIxO1Mibe
- TLSH T12FA78C0673E601A6E5B3D2788AAB5103D773B4675730CBDF325C07542FAB6E09A3A760
- MD5 SHA1 SHA512 SSDEEP TLSH