Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 03:19
General
- Target TradingView Installer .exe
- Size 101.6MB
- Sample260423-dvbwdshx71
- SHA256 c210dbc29f8e68c0b1e1a3812a9b7bdb0af369436c03a07ae0eb10143b2f75a0
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- Modifies Windows Defender notification settings 3 TTPs 6 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TradingView Installer .exe"C:\Users\Admin\AppData\Local\Temp\TradingView Installer .exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\SyncClient.exe"C:\SyncClient.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Sets service image path in registry
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
-
-
C:\TradingView Installer (3).exe"C:\TradingView Installer (3).exe"2⤵
- Executes dropped EXE
-
-
C:\SyncClient.exeC:\SyncClient.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Sets service image path in registry
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Replay Monitor
Loading Replay Monitor...
Downloads
TradingView Installer (3).exe
1
TIME
memory/4028-37-0x00000238436D0000-0x000002384371C000-memory.dmp
memory/4028-35-0x00000238432C0000-0x000002384333E000-memory.dmp
memory/4028-60-0x00000238436D0000-0x000002384371C000-memory.dmp
memory/4028-36-0x00000238436D0000-0x000002384371C000-memory.dmp
memory/4028-18-0x0000023841AD0000-0x0000023841AD2000-memory.dmp
memory/4876-22-0x000001BEFFF40000-0x000001BEFFF8C000-memory.dmp
memory/4876-13-0x000001BEFE320000-0x000001BEFE322000-memory.dmp
memory/4876-30-0x000001BEFFF40000-0x000001BEFFF8C000-memory.dmp
memory/4876-21-0x000001BEFFF40000-0x000001BEFFF8C000-memory.dmp
memory/4876-11-0x000001BEFE320000-0x000001BEFE322000-memory.dmp
memory/4876-46-0x000001BEFE320000-0x000001BEFE322000-memory.dmp
memory/4876-50-0x0000000180000000-0x0000000180056000-memory.dmp
memory/4876-58-0x000001BE80090000-0x000001BE8009C000-memory.dmp
memory/4876-59-0x000001BEFFF40000-0x000001BEFFF8C000-memory.dmp
memory/4876-20-0x000001BEFE340000-0x000001BEFE3BE000-memory.dmp
memory/4884-9-0x000001B5366A0000-0x000001B5367BE000-memory.dmp