Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 12:14
General
- Target inkscape-1.4.3-installer.exe
- Size 2.0MB
- Sample260511-peg81scx2r
- SHA256 26b5d80ff37fd17654e5a4642a6c9c3e30381633f059272718dc65ba7a2c6c65
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 6 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\inkscape-1.4.3-installer.exe"C:\Users\Admin\AppData\Local\Temp\inkscape-1.4.3-installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SQKIHWFODQ.tmp\inkscape-1.4.3-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-SQKIHWFODQ.tmp\inkscape-1.4.3-installer.tmp" /SL5="$50240,847735,840192,C:\Users\Admin\AppData\Local\Temp\inkscape-1.4.3-installer.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
inkscape-1.4.3-installer.tmp
100.png
101.png
image.png
memory/1160-33-0x0000000001850000-0x000000000199D000-memory.dmp
memory/1160-37-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-21-0x0000000001850000-0x000000000199D000-memory.dmp
memory/1160-23-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-22-0x0000000001A50000-0x0000000001A51000-memory.dmp
memory/1160-20-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-76-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-28-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-29-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-30-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-77-0x0000000001850000-0x000000000199D000-memory.dmp
memory/1160-32-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-5-0x0000000001A50000-0x0000000001A51000-memory.dmp
memory/1160-18-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-38-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-39-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-41-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-43-0x0000000005360000-0x00000000054A0000-memory.dmp
memory/1160-45-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-48-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-54-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-57-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/1160-66-0x0000000000A70000-0x0000000000EA6000-memory.dmp
memory/3048-0-0x0000000000470000-0x000000000054C000-memory.dmp
memory/3048-19-0x0000000000470000-0x000000000054C000-memory.dmp