Analysis
- max time kernel
145s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 12:14
Behavioral task
behavioral1
Sample
AES.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
General
- Target AES.exe
- Size 1.0MB
- Sample261113-pec93avt8m
- SHA256 abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169
- MD5 18a33d82d2a081f51cddb34904430ba0
- SHA1 c1138946e02d457400d025b8a6f18d2e6db68566
- SHA512 fad2682da333434b68dd5de77a33c81a5c7432401e48ae2adb33fee9ba8d7d8e2dd837f6cd35da804f6f762865067c53c2382b82e4bfa3d517cd47bf87e3b6f9
- SSDEEP 24576:KaGeudUS7tdzv5k+zhHSnMA152c6D5QZlm6DcgwcOvaJazTc7cQQa2FZHjsIkQDo:KdeudUS7tdzy+tHSnMa52c6DmZlm6Dfs
- TLSH T170353C37E26350ECC46BC1B0431BA1B27E31BC5E5630B92E0694B7B02E76F906A7DB55
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects NimPlant 3 IoCs
resource yara_rule behavioral2/memory/4052-0-0x00007FF6C8DA0000-0x00007FF6C8EAC000-memory.dmp family_nimplant behavioral2/memory/4052-1-0x00007FF6C8DA0000-0x00007FF6C8EAC000-memory.dmp family_nimplant behavioral2/memory/4052-5-0x00007FF6C8DA0000-0x00007FF6C8EAC000-memory.dmp family_nimplant