Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/06/2026, 00:00
General
- Target Radarr.master.6.1.1.10360.windows-core-x64-installer.exe
- Size 77.9MB
- Sample260603-aagpcse18s
- SHA256 2518073c58d365e7b53c05fe8859c1697a7de69c37143d2a2e09e45d2c1cc957
Malware Config
Signatures
- Creates new service(s) 2 TTPs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies data under HKEY_USERS 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Radarr.master.6.1.1.10360.windows-core-x64-installer.exe"C:\Users\Admin\AppData\Local\Temp\Radarr.master.6.1.1.10360.windows-core-x64-installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CVIBOUMEA8.tmp\Radarr.master.6.1.1.10360.windows-core-x64-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-CVIBOUMEA8.tmp\Radarr.master.6.1.1.10360.windows-core-x64-installer.tmp" /SL5="$602D6,80396347,893952,C:\Users\Admin\AppData\Local\Temp\Radarr.master.6.1.1.10360.windows-core-x64-installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"net" stop radarr3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop radarr4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\sc.exe"sc" delete radarr3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Radarr\bin\Radarr.Console.exe"C:\ProgramData\Radarr\bin\Radarr.Console.exe" /u /exitimmediately3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Radarr\bin\Radarr.Console.exe"C:\ProgramData\Radarr\bin\Radarr.Console.exe" /i /exitimmediately3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create Radarr DisplayName= "Radarr" binpath= "C:\ProgramData\Radarr\bin\Radarr.Console.exe" start= auto depend= EventLog/Tcpip/http obj= "NT AUTHORITY\LocalService"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" description Radarr "Radarr Application Server"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" sdshow Radarr4⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" sdset Radarr D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPLOCRRC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)4⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start Radarr4⤵
- Launches sc.exe
-
-
-
C:\ProgramData\Radarr\bin\Radarr.exe"C:\ProgramData\Radarr\bin\Radarr.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Radarr\bin\ffprobe.exe"C:\ProgramData\Radarr\bin\ffprobe.exe" -version4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Radarr\bin\ffprobe.exe"C:\ProgramData\Radarr\bin\ffprobe.exe" -loglevel error -print_format json -show_pixel_formats4⤵
- Executes dropped EXE
-
-
-
-
C:\ProgramData\Radarr\bin\Radarr.Console.exeC:\ProgramData\Radarr\bin\Radarr.Console.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Radarr\bin\ffprobe.exe"C:\ProgramData\Radarr\bin\ffprobe.exe" -version2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Radarr\bin\ffprobe.exe"C:\ProgramData\Radarr\bin\ffprobe.exe" -loglevel error -print_format json -show_pixel_formats2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
is-M7P5HIZT00.tmp
Microsoft.AspNetCore.Connections.Abstractions.dll
Microsoft.Extensions.Hosting.Abstractions.dll
Microsoft.Win32.Primitives.dll
NLog.Layouts.ClefJsonLayout.dll
NLog.dll
Radarr.Common.dll
Radarr.Console.deps.json
Radarr.Console.dll
Radarr.Console.exe
Radarr.Console.runtimeconfig.json
Radarr.Host.dll
Radarr.exe
Sentry.dll
System.Collections.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.dll
System.Console.dll
System.Diagnostics.Process.dll
System.IO.Compression.dll
System.IO.FileSystem.Watcher.dll
System.Linq.dll
System.Memory.dll
System.Net.Mail.dll
System.Net.Primitives.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Reflection.Emit.Lightweight.dll
System.Runtime.InteropServices.dll
System.Runtime.dll
System.Text.Json.dll
System.Text.RegularExpressions.dll
System.Threading.Thread.dll
System.Threading.dll
clrjit.dll
coreclr.dll
hostfxr.dll
hostpolicy.dll
netstandard.dll
config.xml
config.xml
config.xml
config.xml
radarr.debug.txt
radarr.txt
Radarr.master.6.1.1.10360.windows-core-x64-installer.tmp
memory/1236-4915-0x00007FF71D270000-0x00007FF71E725000-memory.dmp
memory/1476-4917-0x00007FF71D270000-0x00007FF71E725000-memory.dmp
memory/1800-4930-0x0000000000700000-0x00000000007E9000-memory.dmp
memory/1800-1-0x0000000000700000-0x00000000007E9000-memory.dmp
memory/1800-69-0x0000000000700000-0x00000000007E9000-memory.dmp
memory/4492-71-0x0000000000A00000-0x0000000000E4B000-memory.dmp
memory/4492-76-0x0000000001810000-0x0000000001811000-memory.dmp
memory/4492-4919-0x0000000000A00000-0x0000000000E4B000-memory.dmp
memory/4492-1776-0x0000000000A00000-0x0000000000E4B000-memory.dmp
memory/4492-5-0x0000000001810000-0x0000000001811000-memory.dmp
memory/5188-7076-0x00007FF71D270000-0x00007FF71E725000-memory.dmp
memory/5256-7079-0x00007FF71D270000-0x00007FF71E725000-memory.dmp