Analysis
- user interaction
yes - max time kernel
175s - max time network
158s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 15:47
General
- Target TWETL(64-bit).exe
- Size 126.5MB
- Sample260417-s792aaex2x
- SHA256 1b708a3c7c477688881a68f70274c7bb391f2cc2604823b76d535d8453350720
Malware Config
Signatures
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 6 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TWETL(64-bit).exe"C:\Users\Admin\AppData\Local\Temp\TWETL(64-bit).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{C85DECDD-475F-4463-8423-9F3561B37B9E}\setup.exeC:\Users\Admin\AppData\Local\Temp\{C85DECDD-475F-4463-8423-9F3561B37B9E}\setup.exe -package:"C:\Users\Admin\AppData\Local\Temp\TWETL(64-bit).exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{C85DECDD-475F-4463-8423-9F3561B37B9E}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{C85DECDD-475F-4463-8423-9F3561B37B9E}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{C85DECDD-475F-4463-8423-9F3561B37B9E}\Disk1\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9A7E3A1-4BF3-484F-8D67-CB18B08197A0}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C115F0EB-E19C-4034-A879-DBBA352FAA7F}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6993BD39-3701-4811-BC1A-2D91C52C00FE}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95A9D7E8-C89A-434F-B49F-C72D798BF8D0}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C2D90DBE-5515-4E44-9D04-E1B837B4836A}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{DD02258F-C028-4DA4-A18A-9C9777D150E5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F9BBDCDC-5FFA-43D8-A41E-1346F9A7B466}3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\SysWOW64\icacls.exe "C:\Program Files\TrackWise ETL\etl_apps\t\t" /grant Users:(OI)(CI)M /T /C3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c install_service.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exet.exe //IS//t4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start_service.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exet.exe //ES//t4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exe"C:\Program Files\TrackWise ETL\etl_apps\t\t.exe" //RS//t1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exe"C:\Program Files\TrackWise ETL\etl_apps\t\t.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TrackWise ETL\etl_apps\t\start_service.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exet.exe //ES//t2⤵
- Executes dropped EXE
-
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exe"C:\Program Files\TrackWise ETL\etl_apps\t\t.exe" //RS//t1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TrackWise ETL\etl_apps\t\install_service.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exet.exe //IS//t2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TrackWise ETL\etl_apps\t\install_service.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exet.exe //IS//t2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TrackWise ETL\etl_apps\t\install_service.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exet.exe //IS//t2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TrackWise ETL\etl_apps\t\install_service.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\TrackWise ETL\etl_apps\t\t.exet.exe //IS//t2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
setup.ini
install_service.bat
commons-daemon.2026-04-17.log
stderr.txt
start_service.bat
t.exe
ETL.class
apa13A2.tmp
axi13D8.tmp
com1508.tmp
jav1929.tmp
jax193E.tmp
jax1952.tmp
jib19CF.tmp
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
0x0409.ini
ISSetup.dll
data1.cab
data1.hdr
layout.bin
setup.exe
setup.inx
setup.ini
ISBEW64.exe
DIFxData.ini
FontData.ini
_isres_0x0409.dll
_isuser_0x0409.dll
isrt.dll
memory/936-123-0x000002AF49620000-0x000002AF496C3000-memory.dmp
memory/1236-1989-0x0000000010000000-0x0000000010112000-memory.dmp
memory/1236-142-0x0000000010000000-0x0000000010112000-memory.dmp
memory/1236-105-0x0000000005C80000-0x0000000005E47000-memory.dmp
memory/1236-99-0x0000000010000000-0x0000000010112000-memory.dmp
memory/1236-100-0x0000000004D80000-0x0000000004D82000-memory.dmp
memory/2304-1996-0x00000256FF960000-0x00000256FFA03000-memory.dmp
memory/2304-1993-0x00000256FF960000-0x00000256FFA03000-memory.dmp
memory/2304-143-0x00000256FF960000-0x00000256FFA03000-memory.dmp
memory/3380-1994-0x000001F0EDFC0000-0x000001F0EE063000-memory.dmp
memory/3380-1995-0x000001F0EDFC0000-0x000001F0EE063000-memory.dmp
memory/3380-144-0x000001F0EDFC0000-0x000001F0EE063000-memory.dmp
memory/4184-119-0x000001AA17900000-0x000001AA179A3000-memory.dmp
memory/4388-130-0x0000013B0C280000-0x0000013B0C323000-memory.dmp
memory/4788-121-0x000001D46E870000-0x000001D46E913000-memory.dmp