Analysis
- user interaction
yes - max time kernel
210s - max time network
209s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 20:04
General
- Target Xfer.Records.Serum.v2.1.2.update.rar
- Size 10.1MB
- Sample260423-ythb1agz6x
- SHA256 c4621ba2ca0816e2f8da391c9e088187b4ce65b7f828eac06a36af381ff802aa
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Drops file in Program Files directory 18 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 7 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xfer.Records.Serum.v2.1.2.update.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3IIR9.tmp\Xfer Records Serum v2.1.2 update.tmp"C:\Users\Admin\AppData\Local\Temp\is-3IIR9.tmp\Xfer Records Serum v2.1.2 update.tmp" /SL5="$40282,9430864,903680,C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QMV6G.tmp\Xfer Records Serum v2.1.2 update.tmp"C:\Users\Admin\AppData\Local\Temp\is-QMV6G.tmp\Xfer Records Serum v2.1.2 update.tmp" /SL5="$60282,9430864,903680,C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Downloads\VR.nfo"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4K3VI.tmp\Xfer Records Serum v2.1.2 update.tmp"C:\Users\Admin\AppData\Local\Temp\is-4K3VI.tmp\Xfer Records Serum v2.1.2 update.tmp" /SL5="$A0060,9430864,903680,C:\Users\Admin\Downloads\Xfer Records Serum v2.1.2 update.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
moduleinfo.json
Serum2.vst3
PlugIn.ico
desktop.ini
SearchHoverUnifiedTileModelCache.dat
SearchHoverUnifiedTileModelCache.dat
Xfer Records Serum v2.1.2 update.tmp
DX.sfz
panel_osc_pitch_mode_v2.1.png
panel_osc_pitch_mode_v2.1.png
VR.nfo
Xfer Records Serum v2.1.2 update.exe
memory/1560-65-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/1560-66-0x0000000000BF0000-0x0000000000CB2000-memory.dmp
memory/1924-9-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/1924-34-0x0000000000A50000-0x0000000000B62000-memory.dmp
memory/1924-33-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/2000-121-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/2000-152-0x00000000009A0000-0x0000000000AB2000-memory.dmp
memory/2000-151-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/2492-118-0x0000011C87450000-0x0000011C875EA000-memory.dmp
memory/2492-116-0x0000011C87450000-0x0000011C875EA000-memory.dmp
memory/2784-37-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/2784-68-0x0000000000AE0000-0x0000000000BF2000-memory.dmp
memory/2784-67-0x0000000000400000-0x00000000004EB000-memory.dmp
memory/3024-31-0x0000000000400000-0x00000000007A0000-memory.dmp
memory/3024-32-0x0000000000E50000-0x0000000000F12000-memory.dmp
memory/3292-35-0x000001FD382A0000-0x000001FD383C0000-memory.dmp
memory/3292-111-0x000001FD382A0000-0x000001FD383C0000-memory.dmp
memory/3292-72-0x000001FD382A0000-0x000001FD383C0000-memory.dmp
memory/3292-52-0x000001FD382A0000-0x000001FD383C0000-memory.dmp
memory/3292-126-0x000001FD382A0000-0x000001FD383C0000-memory.dmp
memory/3292-0-0x000001FD382A0000-0x000001FD383C0000-memory.dmp
memory/3292-5-0x000001FD382A0000-0x000001FD383C0000-memory.dmp
memory/4260-81-0x000001BE928B0000-0x000001BE92A4A000-memory.dmp
memory/4268-150-0x0000000000D30000-0x0000000000DAA000-memory.dmp
memory/4268-149-0x0000000000400000-0x00000000007A0000-memory.dmp