Overview

overview

7

Static

static

3

5bb6863307...22.exe

windows10-2004-x64

7

5bb6863307...22.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    21/04/2026, 03:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe
  • Size 8.2MB
  • Sample260421-d77tlabs2y
  • SHA256 5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe
    "C:\Users\Admin\AppData\Local\Temp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Users\Admin\AppData\Local\Temp\is-EU44G.tmp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EU44G.tmp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp" /SL5="$310072,7704015,832512,C:\Users\Admin\AppData\Local\Temp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe
        "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe" /i
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:2972
      • C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallDriver.exe
        "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallDriver.exe" /i
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3544
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\install.bat""
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Windows\system32\cacls.exe
          "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
          4⤵
            PID:1956
          • C:\Windows\system32\xcopy.exe
            xcopy /y "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\*" "C:\Program Files (x86)\REALTEK\Realtek Bluetooth\" /s /e
            4⤵
            • Drops file in Program Files directory
            PID:720
          • C:\Windows\system32\pnputil.exe
            pnputil /add-driver "C:\Program Files (x86)\REALTEK\Realtek Bluetooth\*.inf" /install
            4⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            PID:3928
        • C:\Windows\system32\sc.exe
          "sc.exe" config WifiAutoInstallSrv binPath="\"C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe\""
          3⤵
          • Launches sc.exe
          PID:2968
    • C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe
      "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3880
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3684
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{657ee5d3-d20a-654f-870f-f401e337deea}\netrtwlanu6.inf" "9" "45d397c27" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4428
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b3f90195-e50a-4249-8b20-76a3dd8151d6}\Rtkfilter.inf" "9" "49663c6d7" "0000000000000160" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files (x86)\REALTEK\Realtek Bluetooth"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:2080

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          RTUWPSrvcLib.dll
          • Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\RTUWPSrvcLib.dll
          • Size 1.0MB
          • SHA256 c90e635394e3be16852ea256e37799c92dca92f7fee1a61b2b4b88fa3457b6ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Rtlihvs.dll
          • Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\Rtlihvs.dll
          • Size 1.2MB
          • SHA256 bc30fc15f01d3f370e75d9000d2ddb569b38b5022553afa0dfed611ee635e681
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rtwlanu6.sys
          • Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\rtwlanu6.sys
          • Size 15.7MB
          • SHA256 228b1f458650c5f7e1145d049cd6199ae8ec1de3871fb99bbb9795092df604e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RtkFilter.cat
          • Path C:\PROGRA~2\REALTEK\REALTE~1\RtkFilter.cat
          • Size 12KB
          • SHA256 e72818cde600961fb5d7084adcb6d6e1769f6d2144a901c7b023d24cd876c548
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Rtkfilter.inf
          • Path C:\Program Files (x86)\REALTEK\Realtek Bluetooth\Rtkfilter.inf
          • Size 3KB
          • SHA256 330024e42c3ad145235f3ba172537a32ebc1c5f2ea06821147a5cc56494f343b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          rtl8851b_bt_fw_rom_patch.dat
          • Path C:\Program Files (x86)\REALTEK\Realtek Bluetooth\rtl8851b_bt_fw_rom_patch.dat
          • Size 63KB
          • SHA256 81f023e4d6fbf5e88bdd299a0aec2839a850539193b6a8afbad35f94148cdee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          install.bat
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\install.bat
          • Size 1KB
          • SHA256 5f5be22ec35cb4d90bdf61a39cf0ffe755948673245345d23c204dc00dfb0189
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DPInst.exe
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\DPInst.exe
          • Size 1.0MB
          • SHA256 7476d743161c9030ffa9ca910dd93766218735fb6ec17714f3f5249bf133d2ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RtkBtfilter.sys
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\RtkBtfilter.sys
          • Size 815KB
          • SHA256 6f6022462581f8ecb849adca0b928c225dec5145728ed8c2f216eda07e1a95de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          netrtwlanu6.inf
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\netrtwlanu6.inf
          • Size 143KB
          • SHA256 2953eff77319397ee89cfb36b83b31b804147ca02276f35f116ddd0925a757ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-4QB2T.tmp
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-4QB2T.tmp
          • Size 20KB
          • SHA256 31ca0653666c45fdac2fddcbc364e5fa327a6e87f5651297bfe929b1a4d1f050
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-FAV68.tmp
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-FAV68.tmp
          • Size 3KB
          • SHA256 57dcabe9e744a8fcddf6729e79d3e7f99e1495fb71f6083a2152c51e26fdd30c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WifiAutoInstall.ini
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.ini
          • Size 140B
          • SHA256 1261af5ed2f0c49f6afc0966bc2c6fc1478c4e163b7e7dc0862968614282cb2f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WifiAutoInstall.log
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
          • Size 440B
          • SHA256 477a0e8e6c7a632ef7980e68e1bb7c576e5805843d7a490a470812279aec5ff2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WifiAutoInstall.log
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
          • Size 600B
          • SHA256 d46a0323571e0fe9bfbf4ef44f5418c26a3cfce8d015d07edf96b6ebf3b02786
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WifiAutoInstall.log
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
          • Size 1KB
          • SHA256 ebf19ea1c5182864827b2769d6b56eec95750cbcaaec95e4a9769b7042ca273a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WifiAutoInstall.log
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
          • Size 1KB
          • SHA256 18d532bb845ba2a28cf99518675f265f38bfb20b4071a92be0402e4bc7e98f25
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WifiAutoInstallDriver.exe
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallDriver.exe
          • Size 164KB
          • SHA256 4843f20a8dddf6ab4a657cf9773fd0e7115ed447501d0226ce8a07a91085e575
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WifiAutoInstallSrv.exe
          • Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe
          • Size 130KB
          • SHA256 c121844e6eb1865f20f7ea52ab69d917ca78a665303fc3159a756e77aa388e5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-EU44G.tmp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
          • Size 3.0MB
          • SHA256 fd319c0e2d861bb86db794059a2869a141bb72cfe7017c4ba63fdcf7c72fbdfe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET5801.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{657ee5d3-d20a-654f-870f-f401e337deea}\SET5801.tmp
          • Size 972KB
          • SHA256 c2e9d0c5ccd9c1553bf5fd6cc0fb4a2e6524ca71040c738fbd4006f0f01059f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET5824.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{657ee5d3-d20a-654f-870f-f401e337deea}\SET5824.tmp
          • Size 1021KB
          • SHA256 1951e64ef661c7d10ea708a402d41d044f6ac168d25f773787c24d211605867d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET5825.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{657ee5d3-d20a-654f-870f-f401e337deea}\SET5825.tmp
          • Size 1.0MB
          • SHA256 129bcb481e33dcec4d88985e567c8890f4fa4eca0fea6fd8c9c7c11fac85a66a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SET5826.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\{657ee5d3-d20a-654f-870f-f401e337deea}\SET5826.tmp
          • Size 14KB
          • SHA256 04a3a259545ee0f3c48abb8fbf27ff492c5c5c3c230347acd789fb3c6d3ca177
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PidVid_List.dat
          • Path C:\Users\Admin\AppData\Local\Temp\{B3F90~1\PidVid_List.dat
          • Size 1KB
          • SHA256 1341ea5d8e476458ec68560cc8279d93163dbef9f4ded18e431726d91feef82e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RtkBtManServ.exe
          • Path C:\Users\Admin\AppData\Local\Temp\{B3F90~1\RtkBtManServ.exe
          • Size 638KB
          • SHA256 ee528d53fcf36cb328d575ccf48d1d3947f690d07782da1f677cd87d33fff064
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 104KB
          • SHA256 cb4b9dd8cd9607f3704a6b1f6815b0b27692cc448d43949ef27ce795e6a43486
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2080-430-0x0000022775D40000-0x0000022775D4C000-memory.dmp
          Download

          memory/4012-434-0x0000000000400000-0x00000000004D8000-memory.dmp
          Download

          memory/4012-122-0x0000000000400000-0x00000000004D8000-memory.dmp
          Download

          memory/4012-0-0x0000000000400000-0x00000000004D8000-memory.dmp
          Download

          memory/4120-5-0x0000000002800000-0x0000000002801000-memory.dmp
          Download

          memory/4120-433-0x0000000000400000-0x000000000071B000-memory.dmp
          Download

          memory/4120-124-0x0000000002800000-0x0000000002801000-memory.dmp
          Download

          memory/4120-123-0x0000000000400000-0x000000000071B000-memory.dmp
          Download

          memory/4428-295-0x00000250B42E0000-0x00000250B42EC000-memory.dmp
          Download