Analysis
- max time kernel
300s - max time network
298s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
11/05/2026, 18:09
General
- Target OficioDigitalPCPA.exe
- Size 54.0MB
- Sample260511-wref8abw4j
- SHA256 e1f179df4b7c946e7161d61da71c136c2ddd203434f6cd926556894b48c712ea
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 14 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LHFOHJKN0Q.tmp\OficioDigitalPCPA.tmp"C:\Users\Admin\AppData\Local\Temp\is-LHFOHJKN0Q.tmp\OficioDigitalPCPA.tmp" /SL5="$601A4,55365982,887296,C:\Users\Admin\AppData\Local\Temp\OficioDigitalPCPA.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"3⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1808,1733699836465578912,3490013160806068176,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1824 --ignored=" --type=renderer " /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=utility --field-trial-handle=1808,1733699836465578912,3490013160806068176,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2204 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1808,1733699836465578912,3490013160806068176,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1816 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exeC:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1856,15684416736290382021,4215013190673406591,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1864 --ignored=" --type=renderer " /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=utility --field-trial-handle=1856,15684416736290382021,4215013190673406591,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2252 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe"C:\Users\Admin\AppData\Local\ProSoftxUltraToolator\Grape.exe" --type=gpu-process --field-trial-handle=1856,15684416736290382021,4215013190673406591,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1220 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d3dcompiler_47.dll
ffmpeg.dll
libEGL.dll
libGLESv2.dll
OficioDigitalPCPA.tmp
setup.txt
memory/1252-321-0x000001CC2CD90000-0x000001CC2CEB3000-memory.dmp
memory/1252-385-0x000001CC2CD90000-0x000001CC2CEB3000-memory.dmp
memory/1252-259-0x000001CC2CD90000-0x000001CC2CEB3000-memory.dmp
memory/1252-279-0x000001CC2CD90000-0x000001CC2CEB3000-memory.dmp
memory/1252-311-0x000001CC2CD90000-0x000001CC2CEB3000-memory.dmp
memory/1544-312-0x000002A257F60000-0x000002A258083000-memory.dmp
memory/1544-468-0x000002A257F60000-0x000002A258083000-memory.dmp
memory/1544-280-0x000002A257F60000-0x000002A258083000-memory.dmp
memory/1544-260-0x000002A257F60000-0x000002A258083000-memory.dmp
memory/1640-248-0x0000000000D10000-0x0000000000DF8000-memory.dmp
memory/1640-0-0x0000000000D10000-0x0000000000DF8000-memory.dmp
memory/1640-249-0x0000000000C90000-0x0000000000D0B000-memory.dmp
memory/3492-273-0x000001E477410000-0x000001E477533000-memory.dmp
memory/3492-333-0x000001E477410000-0x000001E477533000-memory.dmp
memory/3492-253-0x000001E477410000-0x000001E477533000-memory.dmp
memory/3492-366-0x000001E477410000-0x000001E477533000-memory.dmp
memory/3492-283-0x000001E477410000-0x000001E477533000-memory.dmp
memory/3492-313-0x000001E477410000-0x000001E477533000-memory.dmp
memory/3812-274-0x00000201331C0000-0x00000201332E3000-memory.dmp
memory/3812-254-0x00000201331C0000-0x00000201332E3000-memory.dmp
memory/3812-380-0x00000201331C0000-0x00000201332E3000-memory.dmp
memory/3812-314-0x00000201331C0000-0x00000201332E3000-memory.dmp
memory/3812-304-0x00000201331C0000-0x00000201332E3000-memory.dmp
memory/3812-228-0x00007FF837220000-0x00007FF837221000-memory.dmp
memory/4748-365-0x0000025DFB6C0000-0x0000025DFB7E3000-memory.dmp
memory/4876-315-0x000002C4A6E70000-0x000002C4A6F93000-memory.dmp
memory/4876-305-0x000002C4A6E70000-0x000002C4A6F93000-memory.dmp
memory/4876-285-0x000002C4A6E70000-0x000002C4A6F93000-memory.dmp
memory/4876-461-0x000002C4A6E70000-0x000002C4A6F93000-memory.dmp
memory/4876-345-0x000002C4A6E70000-0x000002C4A6F93000-memory.dmp
memory/4876-255-0x000002C4A6E70000-0x000002C4A6F93000-memory.dmp
memory/4944-250-0x00000000003D0000-0x000000000081A000-memory.dmp
memory/4944-5-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/4944-251-0x0000000001010000-0x000000000108B000-memory.dmp
memory/4944-252-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/5048-374-0x000001FADBC10000-0x000001FADBD33000-memory.dmp
memory/5076-316-0x000001A7376B0000-0x000001A7377D3000-memory.dmp
memory/5076-371-0x000001A7376B0000-0x000001A7377D3000-memory.dmp
memory/5076-346-0x000001A7376B0000-0x000001A7377D3000-memory.dmp
memory/5076-258-0x000001A7376B0000-0x000001A7377D3000-memory.dmp
memory/5076-278-0x000001A7376B0000-0x000001A7377D3000-memory.dmp
memory/5076-402-0x000001A7376B0000-0x000001A7377D3000-memory.dmp
memory/5076-306-0x000001A7376B0000-0x000001A7377D3000-memory.dmp
memory/5076-286-0x000001A7376B0000-0x000001A7377D3000-memory.dmp