Analysis
- user interaction
yes - max time kernel
299s - max time network
279s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 18:09
General
- Target OficioDigitalPCPA.exe
- Size 54.0MB
- Sample260511-wref8abw4j
- SHA256 e1f179df4b7c946e7161d61da71c136c2ddd203434f6cd926556894b48c712ea
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 14 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ZKSFK9228X.tmp\OficioDigitalPCPA.tmp"C:\Users\Admin\AppData\Local\Temp\is-ZKSFK9228X.tmp\OficioDigitalPCPA.tmp" /SL5="$6024A,55365982,887296,C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"3⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1864,1691647831944573601,12139834507638994918,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1876 --ignored=" --type=renderer " /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=utility --field-trial-handle=1864,1691647831944573601,12139834507638994918,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2212 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1864,1691647831944573601,12139834507638994918,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=2292 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exeC:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1912,1902440763759225527,2864623950470545700,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1940 --ignored=" --type=renderer " /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=utility --field-trial-handle=1912,1902440763759225527,2864623950470545700,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2256 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1912,1902440763759225527,2864623950470545700,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=916 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47.dll
chrome_200_percent.pak
ffmpeg.dll
icudtl.dat
en-US.pak
resources.pak
libEGL.dll
libglesv2.dll
v8_context_snapshot.bin
chrome_100_percent.pak
OficioDigitalPCPA.tmp
setup.txt
memory/1292-476-0x0000015CBCE90000-0x0000015CBCFBA000-memory.dmp
memory/3312-480-0x000001E9D4730000-0x000001E9D485A000-memory.dmp
memory/5128-311-0x00007FF987070000-0x00007FF987071000-memory.dmp
memory/5128-341-0x0000026747C70000-0x0000026747CDB000-memory.dmp
memory/5128-490-0x0000026747ED0000-0x0000026747FFA000-memory.dmp
memory/5128-412-0x0000026747ED0000-0x0000026747FFA000-memory.dmp
memory/5128-400-0x0000026747ED0000-0x0000026747FFA000-memory.dmp
memory/5128-364-0x0000026747ED0000-0x0000026747FFA000-memory.dmp
memory/5128-340-0x0000026747ED0000-0x0000026747FFA000-memory.dmp
memory/5156-414-0x0000024E93150000-0x0000024E9327A000-memory.dmp
memory/5156-368-0x0000024E93150000-0x0000024E9327A000-memory.dmp
memory/5156-342-0x0000024E93150000-0x0000024E9327A000-memory.dmp
memory/5156-588-0x0000024E93150000-0x0000024E9327A000-memory.dmp
memory/5200-5-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/5200-338-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/5200-337-0x0000000002DE0000-0x0000000002E3F000-memory.dmp
memory/5200-336-0x0000000000E10000-0x000000000125A000-memory.dmp
memory/5352-435-0x000001C3803D0000-0x000001C3804FA000-memory.dmp
memory/5352-411-0x000001C3803D0000-0x000001C3804FA000-memory.dmp
memory/5352-471-0x000001C3803D0000-0x000001C3804FA000-memory.dmp
memory/5352-339-0x000001C3803D0000-0x000001C3804FA000-memory.dmp
memory/5352-375-0x000001C3803D0000-0x000001C3804FA000-memory.dmp
memory/5388-350-0x00000149D2030000-0x00000149D215A000-memory.dmp
memory/5388-410-0x00000149D2030000-0x00000149D215A000-memory.dmp
memory/5388-596-0x00000149D2030000-0x00000149D215A000-memory.dmp
memory/5388-374-0x00000149D2030000-0x00000149D215A000-memory.dmp
memory/5444-348-0x00000224C8740000-0x00000224C886A000-memory.dmp
memory/5444-498-0x00000224C8740000-0x00000224C886A000-memory.dmp
memory/5444-349-0x00000224C8870000-0x00000224C88DB000-memory.dmp
memory/5444-420-0x00000224C8740000-0x00000224C886A000-memory.dmp
memory/5444-372-0x00000224C8740000-0x00000224C886A000-memory.dmp
memory/5732-0-0x00000000002B0000-0x0000000000398000-memory.dmp
memory/5732-334-0x00000000002B0000-0x0000000000398000-memory.dmp
memory/5732-335-0x0000000000EC0000-0x0000000000F1F000-memory.dmp
memory/6044-443-0x0000024B9B0E0000-0x0000024B9B20A000-memory.dmp
memory/6044-455-0x0000024B9B0E0000-0x0000024B9B20A000-memory.dmp
memory/6044-419-0x0000024B9B0E0000-0x0000024B9B20A000-memory.dmp
memory/6044-347-0x0000024B9B0E0000-0x0000024B9B20A000-memory.dmp
memory/6044-369-0x0000024B9B0E0000-0x0000024B9B20A000-memory.dmp
memory/6044-407-0x0000024B9B0E0000-0x0000024B9B20A000-memory.dmp
memory/6044-381-0x0000024B9B0E0000-0x0000024B9B20A000-memory.dmp