Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 02:04
General
- Target patchApp3en_US.exe
- Size 15.1MB
- Sample260529-chpfaaay2j
- SHA256 5a244028087c9927e8c6713a28d801210e6c597f9dab635127e4f05ebc8936ab
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs .reg file with regedit 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\patchApp3en_US.exe"C:\Users\Admin\AppData\Local\Temp\patchApp3en_US.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\patchApp\patchApp\setup.exe"C:\Users\Admin\Desktop\patchApp\patchApp\setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REGEDIT /E DiInfo.REG "HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Director\11\Installation"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regedit.exeREGEDIT /E DiInfo.REG "HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Director\11\Installation"4⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
7Z.DLL
Proj.dll
PkgInfo
Current
Resources
Info.plist
Projector
Projector.rsrc
projector.icns
Setup.exe
memory/812-6-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/812-0-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/812-163-0x0000000010000000-0x0000000010038000-memory.dmp
memory/812-162-0x0000000000400000-0x0000000000502000-memory.dmp
memory/812-7-0x0000000010000000-0x0000000010038000-memory.dmp
memory/812-1-0x000000000048E000-0x000000000048F000-memory.dmp
memory/812-231-0x0000000000400000-0x0000000000502000-memory.dmp
memory/812-233-0x0000000010000000-0x0000000010038000-memory.dmp