Analysis
- max time kernel
899s - max time network
887s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 14:34
General
- Target Portmaster_2.1.7_x64-setup.exe
- Size 78.1MB
- Sample260506-rxgrbahs3q
- SHA256 0f30cfa523810eb661d920b3d22d9ef8f471b372bfcf381ffa6854d1c321418d
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 8 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Portmaster_2.1.7_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\Portmaster_2.1.7_x64-setup.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Portmaster\portmaster.exe"C:\Program Files\Portmaster\portmaster.exe" --with-prompts --with-notifications --background1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WebView2Loader.dll
portmaster.exe
SimpleSC.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
nsis_tauri_utils.dll
memory/4852-17-0x0000000004F00000-0x000000000501C000-memory.dmp
memory/4852-52-0x0000000005320000-0x000000000543C000-memory.dmp
memory/5244-97-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-103-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-73-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-75-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-76-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-77-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-78-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-79-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-80-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-81-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-82-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-83-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-84-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-85-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-86-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-87-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-88-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-89-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-90-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-91-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-92-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-93-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-94-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-95-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-96-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-71-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-98-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-99-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-100-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-101-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-102-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-72-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-104-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-105-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-106-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-107-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-108-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-109-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-110-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-111-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-112-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-113-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-114-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-115-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-116-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-117-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-118-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-119-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-120-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-121-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-122-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-123-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-124-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-125-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-126-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-127-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-128-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-129-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-130-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-131-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-132-0x00007FF798350000-0x00007FF799A3C000-memory.dmp
memory/5244-133-0x00007FF798350000-0x00007FF799A3C000-memory.dmp