8a43b94abbd32987b8391da9d0ebded60e289ea8d5fc18d230099360723e3f69

Resubmissions

03/06/2026, 00:10

260603-agfqmsgx3n6

03/06/2026, 00:10

260603-agcc8agx3k

03/06/2026, 00:08

260603-ae8cwafs3v4

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INSTALLMEEEE.exe
Size 215.8MB
Sample260603-agfqmsgx3n
SHA256 8a43b94abbd32987b8391da9d0ebded60e289ea8d5fc18d230099360723e3f69
MD5 0bf64614fcd5707d810c9529dfebac1d
SHA1 63fe46c227d005eda647c6f902c149d930713873
SHA512 69c7195d859b3ca0757fa1bf367e839c050996ba8e46568130b722d987177d3d3e025dfb9be6ba3da3e83d3c1e7a4ebba6cdaebd31ee4677a8fd4a74971ca0a1
SSDEEP 3145728:OhG77ZJx9Bc/XvspNLfveTWfvs15twm3veYyIu+eAGlb/cEzCl5y2A/+H1/3vaE1:007RYg0OUTPbu+eA8wqClc25yECH4U+P
TLSH
T13DB833764564CF2DD2B2597EB024B219853073670A519839F3CCDA3A3FBB18395BB9C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4740	INSTALLMEEEE.exe

Loads dropped DLL 1 IoCs

pid	Process
4740	INSTALLMEEEE.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INSTALLMEEEE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INSTALLMEEEE.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4740	3464	INSTALLMEEEE.exe	80

C:\Users\Admin\AppData\Local\Temp\INSTALLMEEEE.exe
"C:\Users\Admin\AppData\Local\Temp\INSTALLMEEEE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\Temp\{9D91DDE5-03D2-46E2-9567-ADEF13FCB88D}\.cr\INSTALLMEEEE.exe
  "C:\Windows\Temp\{9D91DDE5-03D2-46E2-9567-ADEF13FCB88D}\.cr\INSTALLMEEEE.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\INSTALLMEEEE.exe" -burn.filehandle.attached=732 -burn.filehandle.self=736
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bg.png

Path C:\Windows\Temp\{04E2D715-D870-44D2-95F1-973A700F1CD5}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{04E2D715-D870-44D2-95F1-973A700F1CD5}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLMEEEE.exe

Path C:\Windows\Temp\{9D91DDE5-03D2-46E2-9567-ADEF13FCB88D}\.cr\INSTALLMEEEE.exe
Size 639KB
SHA256 8beabaf87b70f5723473ff07cc80be5859083321d1a6c251793c062069775f4d
MD5 1ba10aeea851c8a1f06f4a8b2574aa63
SHA1 d3ef582ff71e6945cf54210c12dac8523feecbe8
SHA512 5bc9d6eccb48ddffb9d44d33581ef102082a03707b86ab420a0eab63f14cac9a4809bd56cc13d7191d8d6953be9f3efb450f434a61a2b040d8cac40cf6519bc8
SSDEEP 12288:y3mgqnIZuYfCYqFet4CovkM7ddunEVVS5JJLGHaeiaSd6cON:y3WnIZuMCxezot7DCwVSPISVk
TLSH
T1BFD49D32A5614033FBF10573B928A6303E7CE7282751C8A9E7D4AD1D7EA54C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads