9d3f0f826f3c154499bba1c241ea658ce3d3639489cb19b79eb4534e9402f6f0

Analysis

user interaction
yes
max time kernel
54s
max time network
42s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CertificadoDigital_PCES.exe
Size 54.0MB
Sample260428-rx229aew2j
SHA256 9d3f0f826f3c154499bba1c241ea658ce3d3639489cb19b79eb4534e9402f6f0
MD5 31a967d51e1b311635453804417cbac2
SHA1 716591b974ef710ac99332fe5f305994927dba14
SHA512 d388d51821a40b8d859bcb947e653922ce70ce8028f39646e7e8ad1397c409dde8a192ed6071b78bb4cd68d65b48eedb407c2ad3b5133dde95d98b5770298b2b
SSDEEP 1572864:sZT5vQnGbS5OtUIYjFbUTtp3+ngP5VsVkmLC:sZTVLZuFbQlPjs+mLC
TLSH
T18CC7333BF19A983FD12597717AB39161553BB910A4028C4692ECF8C8CF791B11E3F68B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1476	CertificadoDigital_PCES.tmp
3568	Grape.exe
724	Grape.exe
2840	Grape.exe
4060	Grape.exe
1104	Grape.exe
4632	Grape.exe
1420	Grape.exe

Loads dropped DLL 12 IoCs

pid	Process
3568	Grape.exe
724	Grape.exe
724	Grape.exe
724	Grape.exe
724	Grape.exe
2840	Grape.exe
4060	Grape.exe
1104	Grape.exe
1104	Grape.exe
1104	Grape.exe
1104	Grape.exe
4632	Grape.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\AutoToolSuperToolware\\Grape.exe"	Grape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Grape = "C:\\Users\\Admin\\AppData\\Local\\AutoToolSuperToolware\\Grape.exe"	Grape.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CertificadoDigital_PCES.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CertificadoDigital_PCES.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4868-0-0x0000000000660000-0x0000000000749000-memory.dmp	innosetup
behavioral2/memory/4868-335-0x0000000000660000-0x0000000000749000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2840	Grape.exe
2840	Grape.exe
4632	Grape.exe
4632	Grape.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1476	4868	CertificadoDigital_PCES.exe	80
PID 1476 wrote to memory of 3568	1476	CertificadoDigital_PCES.tmp	81
PID 3568 wrote to memory of 724	3568	Grape.exe	82
PID 3568 wrote to memory of 724	3568	Grape.exe	82
PID 3568 wrote to memory of 2840	3568	Grape.exe	83
PID 4060 wrote to memory of 1104	4060	Grape.exe	87
PID 4060 wrote to memory of 1104	4060	Grape.exe	87
PID 4060 wrote to memory of 4632	4060	Grape.exe	88

C:\Users\Admin\AppData\Local\Temp\CertificadoDigital_PCES.exe
"C:\Users\Admin\AppData\Local\Temp\CertificadoDigital_PCES.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\is-5XNXEUCCGY.tmp\CertificadoDigital_PCES.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5XNXEUCCGY.tmp\CertificadoDigital_PCES.tmp" /SL5="$6004C,55372638,893952,C:\Users\Admin\AppData\Local\Temp\CertificadoDigital_PCES.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
    "C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
      "C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe" --type=gpu-process --field-trial-handle=1764,2830746931760536366,14046632269047701474,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1780 --ignored=" --type=renderer " /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:724
  - - C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
      "C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe" --type=utility --field-trial-handle=1764,2830746931760536366,14046632269047701474,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2172 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
  "C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe" --type=gpu-process --field-trial-handle=1804,2681670088704047520,12040997150345239992,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1812 --ignored=" --type=renderer " /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1104
- C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
  "C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe" --type=utility --field-trial-handle=1804,2681670088704047520,12040997150345239992,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2232 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe
  "C:\Users\Admin\AppData\Local\AutoToolSuperToolware\Grape.exe" --type=utility --field-trial-handle=1804,2681670088704047520,12040997150345239992,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:1420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\D3DCompiler_47.dll
Size 4.3MB
SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
MD5 fea40e5b591127ae3b065389d058a445
SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
TLSH
T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\chrome_200_percent.pak
Size 312KB
SHA256 cd584f20aeed80fe5852d5d5656a12d25d9116d6b805ddbec3874d310925df2a
MD5 bd66e8de6979dfe12cbaa29390d11a64
SHA1 967916eb7587f0163fbce50c7b4822d06e939d5a
SHA512 f77bd5004d8da54e8588ffcf6962b3244b8e4a9f6310d31f0c7c44d913504577c9e3fb858078705c384649fbcf26223d8f98dd02778e259a8924028f2be3bc1c
SSDEEP 6144:8DQYaR+9bITNNz73QYV85u/oFYvwoytKi6obByPGlPFYKKo+:RfIITDg5u/oFFpxLlFYb
TLSH
T1C064F1E6F3F4AC3CE9971E3351560AA3DD7711350AB7434AC28AAC343D56B9489C938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\ffmpeg.dll
Size 2.2MB
SHA256 1a5ea394d48ec44bdffc87a0a414553acd7496058546fda51f2aa7afc774d277
MD5 8b9523d7903086ac856883180ebacb62
SHA1 2dd60ab51c395faee96d3ce88936124c6cb8cdb1
SHA512 5047265d676c0422d48466fd670f406e4cadb1f673b3caca14fe475e710949f8daae3acf4ed59a1e0a4aec322761bd1f606eeabc39b37e6b9a4f523635a33be4
SSDEEP 49152:+spMRI28259LtbjsjdbVmofrZq/zPhmFyuPAfL1s2OwGNbHRtL:+4b2aux6LNbHD
TLSH
T1BCB5AF07F5FA00E9C02AC27487ABA633FA367C4A4521772F1690A6253F7BF905B5E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\icudtl.dat
Size 10.0MB
SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
MD5 3f019441588332ac8b79a3a3901a5449
SHA1 c8930e95b78deef5b7730102acd39f03965d479a
SHA512 ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9
SSDEEP 196608:gmXwSv9AAQMlptodliXUxR0rHf93WhlA6tnoB:gjKlQMlpgliXUxR0rHf93WhlA6tnoB
TLSH
T167B62846B2EB4EC2F9FBAE70D9F463675426BC016E31815946042F3B1C777E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\locales\en-US.pak
Size 75KB
SHA256 3333cf1fb2b0c15ea819787ba672d2274f3136e6a8729f2e5d2796b740688183
MD5 a2201115723fd61d1e68ab001e6cdca0
SHA1 a97073e22adf7b300e702e717743cd249e64b4fb
SHA512 e68c451602a0c2cd47ee3652daf1d74d87e6e61ebda9166cbb182301f03118b72288968695f85a1bcdefb45e4753ba7187dd5159b6694952f33238af39d89479
SSDEEP 1536:2GBj+Xuwnu0fzEphzDiQ2trhu5uBlgfSOqJedMprkhxv+fDgglgqfowv:2yqXJtzEphSBBlgm+xKgglgFwv
TLSH
T1E2734D5BE3C42235059303627A0377A6AB25E0A967521197BC9CC16C33B7FE4C2776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\resources.pak
Size 8.9MB
SHA256 7b2bccc7c2469d516116e9e9fb3ef9ee397ac98508ccd4f3f6714b7ccd1b9c3f
MD5 fc8c0d2bf591195c8a7ec32b034d3ba4
SHA1 58ada360ee3482b424a8b876446d864ba02e7b7c
SHA512 46d033b476963310fe7386e4ad764ec583d50cc1df2e91e1ae0660f50ee7bad624fa146d867659f6bdb1072f34d2baec466637233e45b5f6df05201a51049dbd
SSDEEP 98304:mOdRYaPrtXSElgA1hMoJm7bgGMy6NFfwbPPs:mOdRYaPrtnWahMWmbl6N0Pk
TLSH
T1ED967D573255103A82DA86FB64BA0603BF376046B41090BCF9ACDDCD5BEED429277B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\swiftshader\libegl.dll
Size 392KB
SHA256 91e118f71d5605b24d58002f152fe7bfe95af85a0027076a944c62609357e16e
MD5 a686afbd8b63a663ab6af10ae14b4f38
SHA1 76f1d873233dc5a2ffd5ed8b003614825755236c
SHA512 b5307e6b254491cbc11bd18395036604ac333f65ee3d64cbd62f2f12bb615f080f1740c3e55e69e3758fa19daefcb8b9bd3cbe19956b77e7ca7a539a7c9ccae5
SSDEEP 6144:C3lNvD9dUn+x5WiqCff0vDixSx9+6ipIJqH48rrAtaWL0W:C3lNvxdUn9iqCfsFcIJqUtar
TLSH
T1FE847D16F7A048B9D067C034C9278A42DA71BCDE0F65E29F2395425E2F77BE49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\swiftshader\libglesv2.dll
Size 3.6MB
SHA256 f1d11680aeba15d3f31fd3982da7a78b460705fd54e6033fd791e5298cdbfcd5
MD5 5d71cefb8378b025f941eba3ccf328e3
SHA1 e6de9c0de7e2c9157bbd4c01f26d2fde6f34e9f4
SHA512 65fdeda1239de431ba4694123ee136f035b21d635d1e17982690e2103d04632023c82571d467dc2fbb349eb8f36765cbaff5e0ea93bd49b64a7fb797bdd79120
SSDEEP 49152:UE8gY3DuOpn+em8kINB/2xPkhDZ0SmDxcJtaRL96Om9MQ0xehKyRGZP+mt1G3eWE:i7GkhDpoWJtaPm9MQ3cA3
TLSH
T12006E803D66F90EFE056EA35971BB332D1B578C574387976676239112BE27202B3B388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\AutoToolSuperToolware\v8_context_snapshot.bin
Size 607KB
SHA256 172d37f02295e53a548907baac6eb33b3c2acaa49c1008bae27acf3a1a0d1c1a
MD5 059c46a6c2a64b3c787d1479cd1e28a6
SHA1 93ab53fd9ffa4822a7c2bf33b3248863bef1abef
SHA512 aec0893b15e3df8c459b3d3c4710d8b0df6809f10dd3138ac0abbee1abe58743a47a31a46c327b8724a34de54b465dc6dfc24d458242cbf335dfa5805dc8a774
SSDEEP 6144:wdBNIyNEDV3VySacNOOU/coSWoiC5/8N2vEtncL+S+3:wdBuLDV3c9cL5m2oHS+3
TLSH
T181D4A454B761EF8BF336817A56C15BA036A4E0441F01BB5B53684FBD3C2FA210D29BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CertificadoDigital_PCES.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5XNXEUCCGY.tmp\CertificadoDigital_PCES.tmp
Size 4.2MB
SHA256 e53b2aac4ffca86bbe58bc9cd912b9cda40c1a066b61576c560ef5395ac0a6b8
MD5 1c3cfb345eb1927f235a8cd8a5b89844
SHA1 43a9c12b57da348a089d2d1f3521b2dbbbea9256
SHA512 998d3d63c92021244161194de9f626278f77cdf6ca77f730d1a142668bcad4b508a2f2cc6096b7a6d399e36b8f85bce502cd0f0904f02ce3c5578c317496ef19
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333PU:7xuHjWfZIzeU
TLSH
T188268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\is-JZ6RL7RW6Q.tmp\chrome_100_percent.pak
Size 175KB
SHA256 65cb11d090b32e0fb3c740a736c13c0a47cb1bcb265c084e3de5bb7474fb662f
MD5 3ff806f44723cee528a1aaee4d3a289e
SHA1 56830e7ff31f803077aed774fafebd4e6c5e6c90
SHA512 03dafb839308d644a9943ba66838536fbd1f606cafe392f90925ce51766b5e3a9064d60ca8463bacf7238258beded570d5a0007f3ce11c14f87b10faa2da2977
SSDEEP 3072:ISzwVnp8YdJtroNdX2w5+vfdYCJdx10khejSTS9SO0vVm7O0U27IIABNHlJsgfI:ISzwVSTNhx5c1YC7x10fSucY7OP2ITQ
TLSH
T1EC04D0E3B3F0AC7EE65B0A3375550B77E93B413506A30309C28689752D5AB80D9DD78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.txt

Path C:\Users\Admin\AppData\Roaming\setup.txt
Size 8B
SHA256 179562272c41176feac4abbb07698d6f2d836fe3ea72c9273bae411c43a6e063
MD5 ffd9215a44bfa1b8ff7d795c40c738e3
SHA1 83220788584e52bc43320d8d1012968385d9a060
SHA512 c6a4a5d6af6d79314abbc4bf04c2c2f7ce7781e69e5d9c128f7c85922996cd45df2d62c76c0c8cffb8615e00d5eb69f22e54be67122dfa03520bacc4b0c0e5b7
MD5 SHA1 SHA512

Submit Download

memory/724-312-0x00007FFD831C0000-0x00007FFD831C1000-memory.dmp

Download

memory/1476-5-0x0000000003320000-0x0000000003321000-memory.dmp

Download

memory/1476-337-0x0000000003320000-0x0000000003321000-memory.dmp

Download

memory/1476-336-0x0000000000060000-0x00000000004AB000-memory.dmp

Download

memory/4868-0-0x0000000000660000-0x0000000000749000-memory.dmp

Download

memory/4868-335-0x0000000000660000-0x0000000000749000-memory.dmp

Download