Analysis
- user interaction
yes - max time kernel
335s - max time network
328s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 03:10
General
- Target setup.exe
- Size 1.5MB
- Sample260424-dn49csdw8s
- SHA256 feb15da5069ed36a9705a19a834f8d4a44d28d79b1e731db252e552cd05ff56e
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 7 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2G4GA.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-2G4GA.tmp\setup.tmp" /SL5="$602DC,1059493,190464,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Necesse-Multiplayer-Fix-Online-v4.3.exe"C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Necesse-Multiplayer-Fix-Online-v4.3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RB6JH.tmp\[FreeTP.Org]Necesse-Multiplayer-Fix-Online-v4.3.tmp"C:\Users\Admin\AppData\Local\Temp\is-RB6JH.tmp\[FreeTP.Org]Necesse-Multiplayer-Fix-Online-v4.3.tmp" /SL5="$802F8,2257062,152064,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Necesse-Multiplayer-Fix-Online-v4.3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
setup.tmp
CheckBox.png
DirFolder.png
Edit.png
GroupFolder.png
HDD.png
HardDrivePanel.png
ProgressBackground.png
ProgressImg.png
RequirementsPanel.png
StatusPanel.png
StatusPanel2.png
WizardImage.jpg
Workspace.png
_shfoldr.dll
botva2.dll
button.png
innocallback.dll
CallbackCtrl.dll
ISDone.dll
b2p.dll
botva2.dll
facompress.dll
unarc.dll
[FreeTP.Org]Necesse-Multiplayer-Fix-Online-v4.3.tmp
Necesse.lnk
Игры По Сети.lnk
FreeTP.Org.url
Necesse.exe
favicon.ico
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
steamworks4j-1.10.1-FAIR.jar
memory/4292-1105-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4292-1126-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4292-969-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4292-971-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4960-46-0x0000000003700000-0x000000000370F000-memory.dmp
memory/4960-37-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-914-0x0000000003550000-0x00000000035C6000-memory.dmp
memory/4960-964-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-966-0x0000000003680000-0x00000000036FE000-memory.dmp
memory/4960-965-0x0000000002450000-0x0000000002469000-memory.dmp
memory/4960-7-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-8-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-655-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-657-0x0000000003550000-0x00000000035C6000-memory.dmp
memory/4960-661-0x0000000061080000-0x000000006110B000-memory.dmp
memory/4960-82-0x0000000007D00000-0x0000000007D59000-memory.dmp
memory/4960-21-0x0000000003550000-0x00000000035C6000-memory.dmp
memory/4960-67-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-58-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-57-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-29-0x0000000073D60000-0x0000000073D71000-memory.dmp
memory/4960-56-0x0000000003700000-0x000000000370F000-memory.dmp
memory/4960-51-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-48-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-47-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-45-0x0000000073D60000-0x0000000073D71000-memory.dmp
memory/4960-36-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-44-0x0000000003680000-0x00000000036FE000-memory.dmp
memory/4960-42-0x0000000002450000-0x0000000002469000-memory.dmp
memory/4960-43-0x0000000003550000-0x00000000035C6000-memory.dmp
memory/4960-33-0x0000000003700000-0x000000000370F000-memory.dmp
memory/4960-912-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4960-38-0x0000000000400000-0x0000000000585000-memory.dmp
memory/5088-1042-0x00000000039D0000-0x00000000039E5000-memory.dmp
memory/5088-999-0x00000000033A0000-0x00000000033AD000-memory.dmp
memory/5088-1106-0x0000000000400000-0x000000000057B000-memory.dmp
memory/5088-1123-0x0000000003210000-0x0000000003229000-memory.dmp
memory/5088-1110-0x00000000039D0000-0x00000000039E5000-memory.dmp
memory/5088-1109-0x00000000033A0000-0x00000000033AD000-memory.dmp
memory/5088-1107-0x0000000003210000-0x0000000003229000-memory.dmp
memory/5088-1124-0x0000000003300000-0x000000000337E000-memory.dmp
memory/5088-1108-0x0000000003300000-0x000000000337E000-memory.dmp
memory/5088-1122-0x0000000000400000-0x000000000057B000-memory.dmp
memory/5988-968-0x0000000000510000-0x000000000058B000-memory.dmp
memory/5988-967-0x0000000000400000-0x0000000000439000-memory.dmp
memory/5988-2-0x000000000041E000-0x000000000041F000-memory.dmp
memory/5988-40-0x0000000000510000-0x000000000058B000-memory.dmp
memory/5988-39-0x0000000000400000-0x0000000000439000-memory.dmp
memory/5988-0-0x0000000000400000-0x0000000000439000-memory.dmp