Analysis
- user interaction
yes - max time kernel
598s - max time network
489s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 15:47
General
- Target TWETL(64-bit).exe
- Size 126.5MB
- Sample260417-s792aaex2x
- SHA256 1b708a3c7c477688881a68f70274c7bb391f2cc2604823b76d535d8453350720
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TWETL(64-bit).exe"C:\Users\Admin\AppData\Local\Temp\TWETL(64-bit).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{998AC86B-D00E-4E8D-B0F5-BD89738592AA}\setup.exeC:\Users\Admin\AppData\Local\Temp\{998AC86B-D00E-4E8D-B0F5-BD89738592AA}\setup.exe -package:"C:\Users\Admin\AppData\Local\Temp\TWETL(64-bit).exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{998AC86B-D00E-4E8D-B0F5-BD89738592AA}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{998AC86B-D00E-4E8D-B0F5-BD89738592AA}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{998AC86B-D00E-4E8D-B0F5-BD89738592AA}\Disk1\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{48B2834C-D5B8-4A6F-BCC9-24F311D01DAB}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E067BCFC-6AB2-4E3D-8FB3-96C8230E7ED2}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9E8E98CE-B6BF-4523-90DD-056FB7CC739F}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6446B539-29CD-456C-933D-55B5629094FA}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B2926DF4-6421-4260-A147-9359C549C846}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{666DB5B2-87AA-4E4A-AF90-7D395C6DEA68}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A5AA6650-BB48-4C18-A40F-2520F923B097}3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ISBEW64.exe
DIFxData.ini
FontData.ini
_isres_0x0409.dll
_isuser_0x0409.dll
isrt.dll
0x0409.ini
ISSetup.dll
data1.cab
data1.hdr
layout.bin
setup.inx
setup.exe
setup.ini
memory/1812-119-0x0000027AD5320000-0x0000027AD5A5F000-memory.dmp
memory/2832-143-0x0000015DBDC50000-0x0000015DBE38F000-memory.dmp
memory/3328-121-0x0000019E84460000-0x0000019E84B9F000-memory.dmp
memory/3712-123-0x0000022A74C70000-0x0000022A753AF000-memory.dmp
memory/4676-144-0x0000025E0FAC0000-0x0000025E101FF000-memory.dmp
memory/4720-105-0x0000000005500000-0x00000000056C7000-memory.dmp
memory/4720-142-0x0000000010000000-0x0000000010112000-memory.dmp
memory/4720-99-0x0000000010000000-0x0000000010112000-memory.dmp
memory/4720-100-0x0000000000A70000-0x0000000000A72000-memory.dmp
memory/4720-232-0x0000000010000000-0x0000000010112000-memory.dmp
memory/4720-250-0x0000000010000000-0x0000000010112000-memory.dmp
memory/4812-125-0x000002C2F26A0000-0x000002C2F2DDF000-memory.dmp