Analysis
- max time kernel
149s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 04:37
General
- Target GOG_Galaxy_2.0.exe
- Size 963KB
- Sample260425-e9a33sfw4w
- SHA256 caec5336c4c6611d0f4bcec33f3c0e82172993be25be2e8eb134a0569e3541bd
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe"C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_ZRdQL\GalaxyInstaller.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_ZRdQL\GalaxyInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
InstallerBootstrapper.log
GalaxyInstaller.exe
icon.ico
payload.campaign
remoteconfig.json
memory/2080-30-0x0000000000400000-0x0000000000641000-memory.dmp
memory/2080-33-0x00000000037C0000-0x0000000003BFB000-memory.dmp
memory/2080-32-0x0000000000D00000-0x0000000000DDF000-memory.dmp
memory/2080-0-0x0000000000400000-0x0000000000641000-memory.dmp
memory/2968-29-0x000000001EC10000-0x000000001F138000-memory.dmp
memory/2968-28-0x000000001E510000-0x000000001E6D2000-memory.dmp
memory/2968-16-0x00000000033B0000-0x00000000033C0000-memory.dmp
memory/2968-34-0x0000000001970000-0x000000000197C000-memory.dmp
memory/2968-35-0x00000000033B0000-0x00000000033C0000-memory.dmp
memory/2968-42-0x00000000033B0000-0x00000000033C0000-memory.dmp
memory/2968-48-0x000000001BEA0000-0x000000001BEB2000-memory.dmp
memory/2968-49-0x00000000033B0000-0x00000000033C0000-memory.dmp
memory/2968-15-0x0000000000F90000-0x0000000001020000-memory.dmp