Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 03:22
General
- Target TradingView Installer .exe
- Size 101.6MB
- Sample260423-dw319shy21
- SHA256 c210dbc29f8e68c0b1e1a3812a9b7bdb0af369436c03a07ae0eb10143b2f75a0
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- Modifies Windows Defender notification settings 3 TTPs 6 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 3 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\TradingView Installer .exe"C:\Users\Admin\AppData\Local\Temp\TradingView Installer .exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\SyncClient.exe"C:\SyncClient.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Sets service image path in registry
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
-
-
C:\TradingView Installer (3).exe"C:\TradingView Installer (3).exe"2⤵
- Executes dropped EXE
-
-
C:\SyncClient.exeC:\SyncClient.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Sets service image path in registry
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Replay Monitor
Loading Replay Monitor...
Downloads
TradingView Installer (3).exe
1
TIME
memory/2120-12-0x000002B581160000-0x000002B58127E000-memory.dmp
memory/3276-31-0x00000208FBB60000-0x00000208FBBAC000-memory.dmp
memory/3276-20-0x00000208FBB60000-0x00000208FBBAC000-memory.dmp
memory/3276-21-0x00000208FBB60000-0x00000208FBBAC000-memory.dmp
memory/3276-19-0x00000208FB730000-0x00000208FB7AE000-memory.dmp
memory/3276-11-0x00000208FB710000-0x00000208FB712000-memory.dmp
memory/3276-9-0x00000208FB710000-0x00000208FB712000-memory.dmp
memory/3276-47-0x0000000180000000-0x0000000180056000-memory.dmp
memory/3276-55-0x00000208FC490000-0x00000208FC8FC000-memory.dmp
memory/3276-57-0x00000208FBB60000-0x00000208FBBAC000-memory.dmp
memory/4080-35-0x0000022EDC620000-0x0000022EDC66C000-memory.dmp
memory/4080-34-0x0000022EDC1F0000-0x0000022EDC26E000-memory.dmp
memory/4080-56-0x0000022EDC6D0000-0x0000022EDCB3C000-memory.dmp