Analysis
- user interaction
yes - max time kernel
71s - max time network
73s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
09/05/2026, 22:54
General
- Target Gopeed-v1.9.3-windows-amd64.exe
- Size 25.2MB
- Sample260509-2vmvnaes3y
- SHA256 34989879ba61f7695a724cd0bd93295a04655bd241dba9245398c1573821af03
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 43 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 31 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gopeed-v1.9.3-windows-amd64.exe"C:\Users\Admin\AppData\Local\Temp\Gopeed-v1.9.3-windows-amd64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3WRMWY2Z47.tmp\Gopeed-v1.9.3-windows-amd64.tmp"C:\Users\Admin\AppData\Local\Temp\is-3WRMWY2Z47.tmp\Gopeed-v1.9.3-windows-amd64.tmp" /SL5="$80266,25255698,842240,C:\Users\Admin\AppData\Local\Temp\Gopeed-v1.9.3-windows-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\gopeed\gopeed.exe"C:\Users\Admin\AppData\Local\Programs\gopeed\gopeed.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Programs\gopeed\gopeed.exe"C:\Users\Admin\AppData\Local\Programs\gopeed\gopeed.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
app_links_plugin.dll
dart_ipc_plugin.dll
app.so
FontManifest.json
NativeAssetsManifest.json
host.exe
MaterialIcons-Regular.otf
icudtl.dat
desktop_drop_plugin.dll
flutter_local_notifications_windows.dll
flutter_windows.dll
gopeed.exe
hotkey_manager_windows_plugin.dll
libgcc_s_seh-1.dll
libgopeed.dll
libstdc++-6.dll
libwinpthread-1.dll
msvcp140.dll
open_dir_windows_plugin.dll
permission_handler_windows_plugin.dll
screen_retriever_plugin.dll
share_plus_plugin.dll
tray_manager_plugin.dll
url_launcher_windows_plugin.dll
vcruntime140.dll
vcruntime140_1.dll
window_manager_plugin.dll
Gopeed-v1.9.3-windows-amd64.tmp
notification_icon.ico
memory/456-193-0x000002A189950000-0x000002A189A70000-memory.dmp
memory/788-169-0x0000000000DE0000-0x0000000000F8C000-memory.dmp
memory/788-100-0x0000000000800000-0x00000000008DC000-memory.dmp
memory/788-0-0x0000000000800000-0x00000000008DC000-memory.dmp
memory/788-101-0x0000000000DE0000-0x0000000000F8C000-memory.dmp
memory/788-168-0x0000000000800000-0x00000000008DC000-memory.dmp
memory/4684-162-0x0000000000760000-0x0000000000B96000-memory.dmp
memory/4684-103-0x00000000037E0000-0x00000000037E1000-memory.dmp
memory/4684-102-0x0000000000760000-0x0000000000B96000-memory.dmp
memory/4684-5-0x00000000037E0000-0x00000000037E1000-memory.dmp
memory/5380-141-0x000002977A8D0000-0x000002977B271000-memory.dmp
memory/5380-140-0x000002977A410000-0x000002977A411000-memory.dmp
memory/5380-144-0x000002977A420000-0x000002977A421000-memory.dmp
memory/5380-143-0x000002977A8D0000-0x000002977B271000-memory.dmp
memory/5380-170-0x00000297766C0000-0x00000297767E0000-memory.dmp
memory/5380-142-0x000002977A8D0000-0x000002977B271000-memory.dmp