Analysis
- user interaction
yes - max time kernel
299s - max time network
266s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 14:19
General
- Target Redact-Setup.exe
- Size 65.9MB
- Sample260529-rm1rfaex4j
- SHA256 7c8b64d28d02a75e59f185d3111b7235ea7d733a436a7c37e84da44a8ee4afba
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redact-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Redact-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-14H2V1SKOS.tmp\Redact-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-14H2V1SKOS.tmp\Redact-Setup.tmp" /SL5="$802FE,67937455,954368,C:\Users\Admin\AppData\Local\Temp\Redact-Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Raven Redact\Redact.exe"C:\Program Files\Raven Redact\Redact.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Raven Redact\Redact.exe"C:\Program Files\Raven Redact\Redact.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QtQml.pyd
qmldir
qminimal.dll
qoffscreen.dll
qwebgl.dll
qxdgdesktopportal.dll
Main.qml
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
qtquick2plugin.dll
is-JUWOQ0SMIQ.tmp
is-J3NSB0W5T9.tmp
is-SXV8Y8732J.tmp
qwindows.dll
qwindowsvistastyle.dll
sip.pyd
Redact.exe
_ctypes.pyd
_hashlib.pyd
libcrypto-3.dll
libffi-8.dll
msvcp140.dll
msvcp140_1.dll
python3.dll
python312.dll
qt5core.dll
qt5gui.dll
qt5network.dll
qt5qml.dll
qt5qmlmodels.dll
qt5quick.dll
qt5widgets.dll
vcruntime140.dll
vcruntime140_1.dll
87a0eadfaa3b93a64a76a72473a9deb9e66234b4.qmlc
Redact-Setup.tmp
memory/4804-2890-0x00000000000F0000-0x00000000001E8000-memory.dmp
memory/4804-7-0x00000000000F0000-0x00000000001E8000-memory.dmp
memory/4804-0-0x00000000000F0000-0x00000000001E8000-memory.dmp
memory/4960-2984-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2995-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2970-0x0000016EA0990000-0x0000016EA0E7C000-memory.dmp
memory/4960-2972-0x00007FFCE2430000-0x00007FFCE2695000-memory.dmp
memory/4960-2969-0x00007FFCE4240000-0x00007FFCE44A3000-memory.dmp
memory/4960-2998-0x0000016EA55F0000-0x0000016EA55F1000-memory.dmp
memory/4960-2990-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-3002-0x00007FF6332C0000-0x00007FF63399F000-memory.dmp
memory/4960-2996-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-3000-0x0000016EA55F0000-0x0000016EA55F1000-memory.dmp
memory/4960-2999-0x0000016EA55F0000-0x0000016EA55F1000-memory.dmp
memory/4960-2991-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2992-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2993-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2994-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-3003-0x0000016EA0990000-0x0000016EA0E7C000-memory.dmp
memory/4960-2981-0x0000016EA1910000-0x0000016EA1911000-memory.dmp
memory/4960-2989-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2988-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2982-0x0000016EA1910000-0x0000016EA1911000-memory.dmp
memory/4960-3001-0x0000016EA55F0000-0x0000016EA55F1000-memory.dmp
memory/4960-2971-0x00007FFCE26A0000-0x00007FFCE2BE1000-memory.dmp
memory/4960-2985-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2986-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4960-2987-0x0000016EA1930000-0x0000016EA1931000-memory.dmp
memory/4980-5-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/4980-2889-0x0000000000430000-0x00000000007E4000-memory.dmp
memory/4980-9-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/4980-8-0x0000000000430000-0x00000000007E4000-memory.dmp
memory/4980-11-0x0000000000430000-0x00000000007E4000-memory.dmp
memory/4980-2826-0x0000000000430000-0x00000000007E4000-memory.dmp
memory/4980-2835-0x0000000000430000-0x00000000007E4000-memory.dmp
memory/5992-2957-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2968-0x00000235BB9D0000-0x00000235BBF11000-memory.dmp
memory/5992-2967-0x00007FF6332C0000-0x00007FF63399F000-memory.dmp
memory/5992-2965-0x00000235C0690000-0x00000235C0691000-memory.dmp
memory/5992-2966-0x00000235C0690000-0x00000235C0691000-memory.dmp
memory/5992-2963-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2962-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2961-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2960-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2959-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2958-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2899-0x00000235BCA40000-0x00000235BCE80000-memory.dmp
memory/5992-2901-0x00000235BCE80000-0x00000235BD080000-memory.dmp
memory/5992-2947-0x00000235BCA10000-0x00000235BCA11000-memory.dmp
memory/5992-2948-0x00000235BCA10000-0x00000235BCA11000-memory.dmp
memory/5992-2949-0x00000235BCA10000-0x00000235BCA11000-memory.dmp
memory/5992-2951-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2952-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2953-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2954-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2955-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2956-0x00000235BCA30000-0x00000235BCA31000-memory.dmp
memory/5992-2877-0x00000235BB9D0000-0x00000235BBF11000-memory.dmp
memory/5992-2880-0x00007FFCE27F0000-0x00007FFCE2A55000-memory.dmp
memory/5992-2876-0x00007FFCE2FB0000-0x00007FFCE349C000-memory.dmp
memory/5992-2858-0x00007FFCF4270000-0x00007FFCF44D3000-memory.dmp