The method of waveform cross correlation (WCC) allows remote monitoring of weak seismic activity induced by underground tests. This type of monitoring is considered as a principal task of on-site inspection under the Comprehensive nuclear-test-ban treaty. On September 11, 2016, a seismic event with body wave magnitude 2.1 was found in automatic processing near the epicenter of the underground explosion conducted by the DPRK on September 9, 2016. This event occurred approximately two days after the test. Using the WCC method, two array stations of the International Monitoring System (IMS), USRK and KSRS, detected Pn-wave arrivals, which were associated with a unique event. Standard automatic processing at the International Data Centre (IDC) did not create an event hypothesis, but in the following interactive processing based on WCC detections, an IDC analyst was able to create a two-station event . Location and other characteristics of this small seismic source indicate that it is likely an aftershock of the preceding explosion. Building on the success of automatic detection and phase association, we carried out an extended analysis, which included later phases and closest non-IMS stations. The final cross correlation solution uses four stations, including MDJ (China) and SEHB (Republic of Korea), with the epicenter approximately 2 km to north-west from the epicenter of the Sept. 9 test. We also located the aftershock epicenter by standard IDC program LocSAT using the arrival times obtained by cross correlation. The distance between the DPRK and LocSAT aftershock epicenters is 25.5 km, i.e. by an order of magnitude larger than that obtained by the WCC relative location method.