Resubmissions
19/05/2026, 14:36
260519-ryj8tse17z719/05/2026, 14:35
260519-rx54xae16w719/05/2026, 14:33
260519-rw8teae1217Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/05/2026, 14:35
General
- Target Gopeed-v1.9.3-windows-amd64.exe
- Size 25.2MB
- Sample260519-rx54xae16w
- SHA256 34989879ba61f7695a724cd0bd93295a04655bd241dba9245398c1573821af03
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gopeed-v1.9.3-windows-amd64.exe"C:\Users\Admin\AppData\Local\Temp\Gopeed-v1.9.3-windows-amd64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QY9GKVGU25.tmp\Gopeed-v1.9.3-windows-amd64.tmp"C:\Users\Admin\AppData\Local\Temp\is-QY9GKVGU25.tmp\Gopeed-v1.9.3-windows-amd64.tmp" /SL5="$50236,25255698,842240,C:\Users\Admin\AppData\Local\Temp\Gopeed-v1.9.3-windows-amd64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Gopeed-v1.9.3-windows-amd64.tmp
memory/576-7-0x0000000000F10000-0x0000000000FEC000-memory.dmp
memory/576-0-0x0000000000F10000-0x0000000000FEC000-memory.dmp
memory/3804-15-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-19-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-8-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-11-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-13-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-5-0x0000000001750000-0x0000000001751000-memory.dmp
memory/3804-17-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-9-0x0000000001750000-0x0000000001751000-memory.dmp
memory/3804-21-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-23-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-25-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-27-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-29-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-31-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-33-0x0000000000370000-0x00000000007A6000-memory.dmp
memory/3804-35-0x0000000000370000-0x00000000007A6000-memory.dmp