Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 23:22
General
- Target Setup.exe
- Size 8.7MB
- Sample260604-3chzesht4j
- SHA256 931a79cfb213b40ace7f1fd07d9e842f89f17b3309dabb6fcc5a7d632e3b8989
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 16 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T73MC.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-T73MC.tmp\Setup.tmp" /SL5="$30258,8572006,153088,C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BASS.dll
ISCRC32c.dll
ISDone.dll
ISMD5.dll
VclStylesInno.dll
_isdecmp.dll
bp.dll
styles.dll
wintb.dll
Setup.tmp
memory/1880-1-0x000000000041E000-0x000000000041F000-memory.dmp
memory/1880-0-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4348-73-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-56-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-42-0x0000000003510000-0x0000000003511000-memory.dmp
memory/4348-40-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-33-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/4348-27-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-26-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/4348-32-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-31-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-30-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-29-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/4348-39-0x0000000003500000-0x0000000003501000-memory.dmp
memory/4348-94-0x0000000003EF0000-0x0000000004030000-memory.dmp
memory/4348-142-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-148-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-41-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-136-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-122-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-44-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-28-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-91-0x0000000003CC0000-0x0000000003EE4000-memory.dmp
memory/4348-23-0x0000000003680000-0x000000000399A000-memory.dmp
memory/4348-86-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-85-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-84-0x0000000003CB0000-0x0000000003CB1000-memory.dmp
memory/4348-83-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-82-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-81-0x0000000003CA0000-0x0000000003CA1000-memory.dmp
memory/4348-80-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-76-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-75-0x0000000003C80000-0x0000000003C81000-memory.dmp
memory/4348-74-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-8-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-72-0x0000000003C70000-0x0000000003C71000-memory.dmp
memory/4348-71-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-70-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-60-0x0000000003C30000-0x0000000003C31000-memory.dmp
memory/4348-59-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-57-0x0000000003C20000-0x0000000003C21000-memory.dmp
memory/4348-43-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-55-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-53-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-52-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-51-0x0000000003C00000-0x0000000003C01000-memory.dmp
memory/4348-50-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-49-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-48-0x0000000003BF0000-0x0000000003BF1000-memory.dmp
memory/4348-38-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-37-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-36-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/4348-35-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-34-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-79-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-78-0x0000000003C90000-0x0000000003C91000-memory.dmp
memory/4348-77-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-68-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-69-0x0000000003C60000-0x0000000003C61000-memory.dmp
memory/4348-67-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-66-0x0000000003C50000-0x0000000003C51000-memory.dmp
memory/4348-65-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-64-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-63-0x0000000003C40000-0x0000000003C41000-memory.dmp
memory/4348-62-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-61-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-58-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-54-0x0000000003C10000-0x0000000003C11000-memory.dmp
memory/4348-47-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-46-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/4348-45-0x0000000003BE0000-0x0000000003BE1000-memory.dmp
memory/4348-149-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-150-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-151-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-152-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-7-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-167-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-168-0x0000000000400000-0x0000000000585000-memory.dmp
memory/4348-169-0x0000000000400000-0x0000000000585000-memory.dmp