Analysis
- max time kernel
599s - max time network
472s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 04:03
General
- Target Mine-imator 1.2.9 installer.exe
- Size 12.6MB
- Sample260620-emegzset3z
- SHA256 9c86c7609013696f3fe3b17ec8b4486fa157b87ffd66758968df06c9604acd59
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mine-imator 1.2.9 installer.exe"C:\Users\Admin\AppData\Local\Temp\Mine-imator 1.2.9 installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8K9PJ.tmp\Mine-imator 1.2.9 installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-8K9PJ.tmp\Mine-imator 1.2.9 installer.tmp" /SL5="$4020C,12238071,935424,C:\Users\Admin\AppData\Local\Temp\Mine-imator 1.2.9 installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Mine-imator 1.2.9 installer.tmp
memory/3036-6-0x0000000002640000-0x0000000002641000-memory.dmp
memory/3036-10-0x0000000002640000-0x0000000002641000-memory.dmp
memory/3036-9-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-12-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-14-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-16-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-18-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-20-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-22-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-24-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-26-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-28-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-30-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-32-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-34-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-36-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-38-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-40-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-42-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-44-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-46-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-48-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-50-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-52-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-54-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-56-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-58-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-60-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-62-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-64-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-66-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-68-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-70-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-72-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-74-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-76-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-78-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-80-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-82-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-84-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-86-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-90-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-92-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-94-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-96-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-98-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-100-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-102-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-104-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-106-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-108-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-110-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-112-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-114-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-116-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-118-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-120-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-122-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-124-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-126-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3036-128-0x0000000000400000-0x000000000072B000-memory.dmp
memory/3420-0-0x0000000000400000-0x00000000004F2000-memory.dmp
memory/3420-8-0x0000000000400000-0x00000000004F2000-memory.dmp