Analysis
- max time kernel
149s - max time network
127s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 11:13
General
- Target StreamScope_Setup_v1.4.2.exe
- Size 66.7MB
- Sample260528-nbmtnae15w
- SHA256 37b033c296148358a86114c03e47e4117d44b7b0cd8c824354b93a2e2ea39d82
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\StreamScope_Setup_v1.4.2.exe"C:\Users\Admin\AppData\Local\Temp\StreamScope_Setup_v1.4.2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E61FXQAHJD.tmp\StreamScope_Setup_v1.4.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-E61FXQAHJD.tmp\StreamScope_Setup_v1.4.2.tmp" /SL5="$4024C,68879224,934400,C:\Users\Admin\AppData\Local\Temp\StreamScope_Setup_v1.4.2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\StreamScope\StreamScope.exe"C:\Users\Admin\AppData\Local\Programs\StreamScope\StreamScope.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\STREAM~1\StreamScope.exe"C:\Users\Admin\AppData\Local\Programs\STREAM~1\StreamScope.exe" "--multiprocessing-fork" "parent_pid=5576" "pipe_handle=1052"4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
libcrypto-3.dll
rect.pyd
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_overlapped.pyd
_socket.pyd
_ssl.pyd
is-MQL2X99NM5.tmp
libffi-8.dll
libssl-3.dll
is-C9LPR29QHO.tmp
SDL2.dll
SDL2_image.dll
base.pyd
bufferproxy.pyd
color.pyd
constants.pyd
display.pyd
draw.pyd
event.pyd
image.pyd
imageext.pyd
math.pyd
rwobject.pyd
surface.pyd
surflock.pyd
python313.dll
select.pyd
unicodedata.pyd
vcruntime140.dll
StreamScope_Setup_v1.4.2.tmp
memory/852-1330-0x00007FF9D98F0000-0x00007FF9D9B5C000-memory.dmp
memory/852-1334-0x00000221DDD90000-0x00000221DF10E000-memory.dmp
memory/852-1331-0x000000006A880000-0x000000006A8A7000-memory.dmp
memory/852-1332-0x0000000068B40000-0x0000000068B7C000-memory.dmp
memory/852-1335-0x0000000064FC0000-0x000000006505A000-memory.dmp
memory/852-1333-0x0000000062E80000-0x0000000062EA4000-memory.dmp
memory/3488-10-0x00000000000B0000-0x00000000001A3000-memory.dmp
memory/3488-0-0x00000000000B0000-0x00000000001A3000-memory.dmp
memory/3488-1277-0x00000000000B0000-0x00000000001A3000-memory.dmp
memory/4900-12-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/4900-1276-0x0000000000A80000-0x0000000000E2F000-memory.dmp
memory/4900-5-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/4900-1180-0x0000000000A80000-0x0000000000E2F000-memory.dmp
memory/4900-11-0x0000000000A80000-0x0000000000E2F000-memory.dmp
memory/5576-1329-0x0000000064FC0000-0x000000006505A000-memory.dmp
memory/5576-1327-0x0000000068B40000-0x0000000068B7C000-memory.dmp
memory/5576-1325-0x00007FF9D98F0000-0x00007FF9D9B5C000-memory.dmp
memory/5576-1328-0x0000000062E80000-0x0000000062EA4000-memory.dmp
memory/5576-1326-0x000000006A880000-0x000000006A8A7000-memory.dmp