Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 23:32
General
- Target AtlasToolkitSetup.exe
- Size 3.9MB
- Sample260620-3jmaesat3p
- SHA256 09384283de9a6a18a864ba36bc2c0ba0996395fbc4a4f9c4ccbbcd98f606acc8
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AtlasToolkitSetup.exe"C:\Users\Admin\AppData\Local\Temp\AtlasToolkitSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7Q7IV90HWH.tmp\AtlasToolkitSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7Q7IV90HWH.tmp\AtlasToolkitSetup.tmp" /SL5="$502B0,2828391,1003008,C:\Users\Admin\AppData\Local\Temp\AtlasToolkitSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Atlas Toolkit\AtlasToolkit.exe"C:\Users\Admin\AppData\Local\Programs\Atlas Toolkit\AtlasToolkit.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AtlasToolkit.deps.json
AtlasToolkit.dll
AtlasToolkit.exe
AtlasToolkit.runtimeconfig.json
AtlasToolkitSetup.tmp
memory/2316-7-0x0000000000980000-0x0000000000A83000-memory.dmp
memory/2316-0-0x0000000000980000-0x0000000000A83000-memory.dmp
memory/2316-82-0x0000000000980000-0x0000000000A83000-memory.dmp
memory/6072-12-0x0000000000BA0000-0x0000000000FFE000-memory.dmp
memory/6072-14-0x0000000000BA0000-0x0000000000FFE000-memory.dmp
memory/6072-16-0x0000000000BA0000-0x0000000000FFE000-memory.dmp
memory/6072-9-0x0000000001540000-0x0000000001541000-memory.dmp
memory/6072-8-0x0000000000BA0000-0x0000000000FFE000-memory.dmp
memory/6072-6-0x0000000001540000-0x0000000001541000-memory.dmp
memory/6072-81-0x0000000000BA0000-0x0000000000FFE000-memory.dmp