Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
14/12/2025, 09:51
General
- Target file.exe
- Size 4.4MB
- Sample251214-lvldtstjam
- SHA256 1c19ab0611daf084a84fdb7b472600e1b7c9e5885130a827c3e1111eab08931d
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 16 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HK7LG.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-HK7LG.tmp\file.tmp" /SL5="$5006E,3531273,865280,C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe" /VERYSILENT /PASSWORD=544c1fac-5e7f-49d9-bca2-4da26e7d38853⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L1R24.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-L1R24.tmp\file.tmp" /SL5="$6006E,3531273,865280,C:\Users\Admin\AppData\Local\Temp\file.exe" /VERYSILENT /PASSWORD=544c1fac-5e7f-49d9-bca2-4da26e7d38854⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exe"C:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exe" -ScanType5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exeC:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exeC:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exe -ScanType1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exeC:\ProgramData\2f88ec0c-df83-41b7-a2cc-06a1dc5b6edd\kxetray.exe -ScanType1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kis.dll
kxetray.exe
microsoft.vc80.crt.manifest
msvcm80.dll
msvcp80.dll
msvcr80.dll
_isdecmp.dll
file.tmp
memory/244-9109-0x0000000074510000-0x0000000074802000-memory.dmp
memory/764-49-0x0000000000170000-0x0000000000253000-memory.dmp
memory/764-12-0x0000000000170000-0x0000000000253000-memory.dmp
memory/1856-16-0x0000000000170000-0x0000000000253000-memory.dmp
memory/1856-0-0x0000000000170000-0x0000000000253000-memory.dmp
memory/4488-141-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-127-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-9095-0x0000000008160000-0x000000000816A000-memory.dmp
memory/4488-56-0x0000000074510000-0x0000000074802000-memory.dmp
memory/4488-6842-0x0000000008400000-0x0000000008484000-memory.dmp
memory/4488-60-0x0000000074510000-0x0000000074802000-memory.dmp
memory/4488-62-0x0000000002D70000-0x0000000003169000-memory.dmp
memory/4488-64-0x0000000074510000-0x0000000074802000-memory.dmp
memory/4488-65-0x0000000005D10000-0x0000000005DCC000-memory.dmp
memory/4488-66-0x0000000005ED0000-0x0000000006074000-memory.dmp
memory/4488-67-0x0000000006090000-0x00000000066A8000-memory.dmp
memory/4488-77-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-81-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-107-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-109-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-157-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-159-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-175-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-173-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-171-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-169-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-167-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-165-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-163-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-161-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-155-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-153-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-151-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-149-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-145-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-143-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-6841-0x0000000007830000-0x0000000007DD6000-memory.dmp
memory/4488-139-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-137-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-135-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-133-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-131-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-147-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-129-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-48-0x0000000074510000-0x0000000074802000-memory.dmp
memory/4488-125-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-121-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-119-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-117-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-115-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-113-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-111-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-123-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-105-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-103-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-101-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-99-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-97-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-95-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-91-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-89-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-87-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-83-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-79-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-75-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-71-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-70-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-93-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-85-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-73-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-68-0x0000000005ED0000-0x000000000606E000-memory.dmp
memory/4488-6830-0x0000000005CE0000-0x0000000005CE8000-memory.dmp
memory/4488-6840-0x0000000007780000-0x0000000007812000-memory.dmp
memory/4488-6837-0x0000000006A10000-0x0000000006A76000-memory.dmp
memory/4924-59-0x0000000074510000-0x0000000074802000-memory.dmp
memory/4924-57-0x0000000074510000-0x0000000074802000-memory.dmp
memory/4944-6836-0x0000000074510000-0x0000000074802000-memory.dmp
memory/4944-9097-0x0000000074510000-0x0000000074802000-memory.dmp
memory/5564-46-0x0000000000EB0000-0x0000000001252000-memory.dmp
memory/5564-21-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/5820-5-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/5820-13-0x00000000008C0000-0x0000000000C62000-memory.dmp