Analysis
- user interaction
yes - max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/06/2026, 16:31
General
- Target ws-Setup-Complete.exe
- Size 1.8MB
- Sample260605-t1ga3aa18w
- SHA256 053cf2aa31d3dbe50d784b5998794ee148e1d74911b8c23ceb5c1b264dd948f8
Malware Config
Extracted
-
remus_stealer
-
http://youngel.biz:8768
-
http://myrtler.biz:9549
-
http://carogra.biz:4219
Extracted
-
hijackloader
-
directory
%APPDATA%\SSL
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Family: Remus
Remus is a stealer written in C++.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Detects Remus stealer 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe"C:\Users\Admin\AppData\Local\Temp\ws-Setup-Complete.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R0wXqZLHa8a27s6o2NJkH2.exe"C:\Users\Admin\AppData\Local\Temp\R0wXqZLHa8a27s6o2NJkH2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-16H95.tmp\R0wXqZLHa8a27s6o2NJkH2.tmp"C:\Users\Admin\AppData\Local\Temp\is-16H95.tmp\R0wXqZLHa8a27s6o2NJkH2.tmp" /SL5="$80246,5987449,121344,C:\Users\Admin\AppData\Local\Temp\R0wXqZLHa8a27s6o2NJkH2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MIC70.tmp\Port-Cryst16.exe"C:\Users\Admin\AppData\Local\Temp\is-MIC70.tmp\Port-Cryst16.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
R0wXqZLHa8a27s6o2NJkH2.exe
R0wXqZLHa8a27s6o2NJkH2.tmp
Port-Cryst16.exe
VCRUNTIME140.dll
asset-diag.ini
binding-fmt.conf
krpt.dll
libHarfBuzzSharp.dll
msvcp140.dll
memory/900-36-0x0000000000400000-0x0000000000428000-memory.dmp
memory/900-5-0x0000000000400000-0x0000000000428000-memory.dmp
memory/900-46-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1032-34-0x0000000074150000-0x0000000074240000-memory.dmp
memory/1032-35-0x00007FFC65C20000-0x00007FFC65E29000-memory.dmp
memory/2416-11-0x0000000000840000-0x0000000000841000-memory.dmp
memory/2416-38-0x0000000000840000-0x0000000000841000-memory.dmp
memory/2416-37-0x0000000000400000-0x000000000052E000-memory.dmp
memory/2416-45-0x0000000000400000-0x000000000052E000-memory.dmp
memory/3356-1-0x0000000140000000-0x000000014003A000-memory.dmp
memory/3356-0-0x0000000140000000-0x000000014003A000-memory.dmp