Analysis
- user interaction
yes - max time kernel
299s - max time network
289s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 14:19
Behavioral task
behavioral1
Sample
Redact.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
Redact.zip
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
Redact-Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
300 seconds
General
- Target Redact-Setup.exe
- Size 65.9MB
- Sample260529-rm1rfaex4j
- SHA256 7c8b64d28d02a75e59f185d3111b7235ea7d733a436a7c37e84da44a8ee4afba
- MD5 4e229846fb1cef32d7edac20879f85b8
- SHA1 88ec6fab96548d260a002cbbce88d8307896f126
- SHA512 65f5ded76085e85a2b0560b6f430523b6dc9ada08cce9d898c17e2c6cf26afc6dc1b083d2031219367cd919179a8bc2b8cc888f57ff8d0ca23cbf026367dcd27
- SSDEEP 1572864:RYsjl2yqoKCj176q5uaLst/Wm21Rjsz+/+VcxOmqfYxJSOl6:RZ8rCZ76T/MlGV/mqfgSOA
- TLSH T1AAE73333A18B573DE06E563B89B1E1719A372F21640A4C41AAE4BC4FFB7E1500D3F65A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 408 Redact-Setup.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Universal\is-UFJYXUAAPW.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Universal\is-2VNJK3RO7C.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\is-1WLEY5QWHX.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtNfc\is-DBSGSGWPI8.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Private\is-1HC6MB3WGP.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Styles\Base\images\is-RQ4LA67GE8.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Dialogs\images\is-DVE0CEV8SE.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Extras\designer\is-14NPAUW88G.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\is-CT8XTZKK7O.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\is-KE2VI3QC06.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\is-LCW19CU03F.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Private\is-VX5G8L2J3W.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Styles\Base\images\is-PYUMWTCY5X.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Imagine\is-3GHVNAD0B8.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Dialogs\Private\is-1JIWADTSSN.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Extras\designer\is-SF0WOHM7IF.tmp Redact-Setup.tmp File opened for modification C:\Program Files\Raven Redact\qt5webview.dll Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\is-S6CAABJLM1.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Styles\Base\images\is-6RPLLV0OGE.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\designer\is-UBGQ6ZJC4X.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\is-NGW8E18ABQ.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\is-O084T6E1P1.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\images\is-QILCYPMCW7.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\Materials\maps\is-TNV227PHWA.tmp Redact-Setup.tmp File opened for modification C:\Program Files\Raven Redact\qt5core.dll Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\designer\images\is-28TD6U51M9.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtMultimedia\is-YG4LLTEEDV.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Private\is-S0ZW37Q7GG.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Private\is-CRE7K2F28Q.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\is-4ZNF43X8HC.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Imagine\is-WIVXJC8QER.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Material\is-VQ0K3GV69T.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Extras\designer\images\is-5SI4WV28DO.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Extras\Private\is-F68ZB91RPH.tmp Redact-Setup.tmp File opened for modification C:\Program Files\Raven Redact\PyQt5\qml\QtQuick.2\qtquick2plugin.dll Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Layouts\is-LMCVMLJ8IH.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\images\is-LON6XWXQBY.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\images\is-J7RUJ1O1SV.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\Helpers\is-17CILHKQJ3.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\Materials\is-NSLTYO9TVW.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtWebChannel\is-SWCK5BWQUL.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtBluetooth\is-ENZ92UBKJ7.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Styles\Desktop\is-8SNYUB4QWM.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Fusion\is-NBL5VY1TSP.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Imagine\is-V1K3KVCKV9.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtGraphicalEffects\is-BVOEB12N5H.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\is-FSKRF1X3NO.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Styles\Base\is-V36G2RRZMV.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls\Styles\Desktop\is-H7CIN77BG3.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\Material\is-GP29G43TX3.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Shapes\is-S1LFZPM20Z.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\images\is-9240SF01RC.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\images\is-WRC6WNWNZD.tmp Redact-Setup.tmp File opened for modification C:\Program Files\Raven Redact\PyQt5\qt-plugins\imageformats\qtiff.dll Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Dialogs\qml\is-AC1PHEY01B.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Extras\is-USFWWU9CJQ.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\Effects\is-W492XFJHNQ.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtNfc\is-OFOFT428N2.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\designer\is-KT86AAML3E.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\LocalStorage\is-RPZQ2CPUGT.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\images\is-3NR7KDAQAT.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\designer\images\is-CLY2RITEDL.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\Materials\designer\source\is-PF83Q4FTSW.tmp Redact-Setup.tmp File created C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\Materials\maps\is-8RXM37NKR3.tmp Redact-Setup.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Redact-Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Redact-Setup.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral3/memory/2004-0-0x0000000000740000-0x0000000000838000-memory.dmp innosetup behavioral3/memory/2004-7-0x0000000000740000-0x0000000000838000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 408 Redact-Setup.tmp 408 Redact-Setup.tmp - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 408 Redact-Setup.tmp - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2004 wrote to memory of 408 2004 Redact-Setup.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redact-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Redact-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\is-GLRC8SNA1H.tmp\Redact-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-GLRC8SNA1H.tmp\Redact-Setup.tmp" /SL5="$801FC,67937455,954368,C:\Users\Admin\AppData\Local\Temp\Redact-Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:408
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Raven Redact\PyQt5\qml\QtQuick3D\Materials\maps\is-TNV227PHWA.tmp
- Size 334B
- SHA256 03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f
- MD5 882310febbcd112f6416015145fd8c6d
- SHA1 e142d0ba597a2c773e6354673bbc4a760f8d963f
- SHA512 b21d8a189123c3019b5c99c1927d9eb10293cbe9321cb54d1fe183bf57efd22f778a61e47be27afb8f54d731ce17f96a6c6452dc76c3a8596b1bf1fdd532d4c4
- TLSH T130E02D9A6790097EC2E7577145C12F2396BB8138251742E644B7543A3C73BA4611BB85
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\designer\is-C326XZZNRJ.tmp
- Size 2KB
- SHA256 8207c603c9de51d9954302dd9df559a1df70e0a9658af62637229b5a2437eec3
- MD5 df7e32b0e18bd35fa8453cb1263886b9
- SHA1 f4336c9380a7fbee4dfbc17c545b409364f7f8b3
- SHA512 21d4e9b1d71c5ea9c7c66e5bacead5d4857ac109f7452d81c6d793f8843dd1d6f9194011e41259cdb9e3faecc04675a1433a2dfcbf0b758ff97cbd068fd95732
- TLSH T12441BB4A66405F3703B20750BE8B83CFF2AB827A775654203C29B29A1B7D87117A27D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Raven Redact\PyQt5\qml\QtQuick\Controls.2\designer\is-Z1G2LFXL3U.tmp
- Size 2KB
- SHA256 07911dff4b3128de29fb83223a78878f9e972f35a596429861c7ea7956923b2d
- MD5 95806d0bfadf617cdb91b9baacab5429
- SHA1 2102999ec25be88f138ea7c8fbf2a1bf4454c766
- SHA512 00d3b1dd1d764859249a5997ec4b2ec68fdf7c245a3ad4276a81370b2f43090f41d32de48d94307703436e661ebaf64ff96332f109b0e611b74521f28c8f8004
- TLSH T1E941CB4B66405F3703B20750BE8F83CBF2AB927A779654203C29B29A1B7D83117A27D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-GLRC8SNA1H.tmp\Redact-Setup.tmp
- Size 3.6MB
- SHA256 f509bd0d7d5ed758999b121c0f8e9f517388861a6345bb07d55b199f19fd0942
- MD5 072720e9604cb8801928c9e272e404e8
- SHA1 43da711a39aadb0aa9ac20f787af9ef0ec030b15
- SHA512 b76aff094ccb9c2023eca194a359103812bfe3c6da61b44c441272fe01fbaedcb8686e1d4bda22e99f6e9b86bc248c17c53280cc8724c942f0c171052486dd17
- SSDEEP 49152:f3SA9I3bZxTZElVySH6UNoO7zjQynN4s7UUZyE8eECaN2MT333lQ:fCbWroSkynN4sQ+TdMT333G
- TLSH T1D2066C13B344643FD06B1A395837EA74543F7E7229128C275AE43E8E7E752802E3A677
- MD5 SHA1 SHA512 SSDEEP TLSH