Analysis
- user interaction
yes - max time kernel
118s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/06/2026, 01:39
General
- Target portals_installer_v3-4-0-0.exe
- Size 6.9MB
- Sample260623-b3f4zaas31
- SHA256 495964ccab0fdbbd370d61c0631cb3e8e0b8cbadb7c6edae6c53c049ed339866
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\portals_installer_v3-4-0-0.exe"C:\Users\Admin\AppData\Local\Temp\portals_installer_v3-4-0-0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Q2G48.tmp\portals_installer_v3-4-0-0.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q2G48.tmp\portals_installer_v3-4-0-0.tmp" /SL5="$702BC,6406496,947712,C:\Users\Admin\AppData\Local\Temp\portals_installer_v3-4-0-0.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\Portals\Portals.exe"C:\Program Files\Portals\Portals.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AutoUpdater.NET.dll
ColorPicker.Models.dll
ColorPicker.dll
GongSolutions.WPF.DragDrop.dll
Hardcodet.NotifyIcon.Wpf.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.Toolkit.Uwp.Notifications.dll
Microsoft.Xaml.Behaviors.dll
Portals.exe
Portals.exe.config
Prism.Wpf.dll
Prism.dll
Sentry.dll
System.Buffers.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
System.Threading.Tasks.Extensions.dll
System.ValueTuple.dll
ToggleSwitch.dll
WindowsDisplayAPI.dll
Portals.resources.dll
portals-session-log-20260623_024106.log
portals-session-log-20260623_024106.log
portals_installer_v3-4-0-0.tmp
memory/876-0-0x0000000000400000-0x00000000004F5000-memory.dmp
memory/876-7-0x0000000000400000-0x00000000004F5000-memory.dmp
memory/876-139-0x0000000000400000-0x00000000004F5000-memory.dmp
memory/2948-201-0x0000026E210A0000-0x0000026E210A8000-memory.dmp
memory/2948-202-0x0000026E25F60000-0x0000026E25F98000-memory.dmp
memory/2948-184-0x0000026E20B50000-0x0000026E20B58000-memory.dmp
memory/2948-185-0x0000026E20B70000-0x0000026E20B78000-memory.dmp
memory/2948-181-0x0000026E20C10000-0x0000026E20CC4000-memory.dmp
memory/2948-158-0x0000026E1ED00000-0x0000026E1ED26000-memory.dmp
memory/2948-191-0x0000026E20BB0000-0x0000026E20BDC000-memory.dmp
memory/2948-144-0x0000026E04BF0000-0x0000026E04C00000-memory.dmp
memory/2948-198-0x0000026E21020000-0x0000026E21044000-memory.dmp
memory/2948-148-0x0000026E04BD0000-0x0000026E04BDA000-memory.dmp
memory/2948-196-0x0000026E21000000-0x0000026E2101A000-memory.dmp
memory/2948-200-0x0000026E21050000-0x0000026E21078000-memory.dmp
memory/2948-143-0x0000026E04550000-0x0000026E0477C000-memory.dmp
memory/2948-162-0x0000026E1ED30000-0x0000026E1ED46000-memory.dmp
memory/2948-203-0x0000026E210D0000-0x0000026E210DE000-memory.dmp
memory/2948-156-0x0000026E20970000-0x0000026E209F2000-memory.dmp
memory/2948-160-0x0000026E065B0000-0x0000026E065BA000-memory.dmp
memory/2948-206-0x0000026E25FA0000-0x0000026E25FD2000-memory.dmp
memory/2948-211-0x0000026E25100000-0x0000026E2510A000-memory.dmp
memory/2948-240-0x0000026E04BF0000-0x0000026E04C00000-memory.dmp
memory/2948-209-0x0000026E25F20000-0x0000026E25F46000-memory.dmp
memory/2948-164-0x0000026E1ECE0000-0x0000026E1ECE8000-memory.dmp
memory/2948-213-0x0000026E26000000-0x0000026E26012000-memory.dmp
memory/2948-234-0x0000026E26610000-0x0000026E26682000-memory.dmp
memory/2948-215-0x0000026E26060000-0x0000026E26082000-memory.dmp
memory/2948-168-0x0000026E1ECF0000-0x0000026E1ECFA000-memory.dmp
memory/2948-166-0x0000026E1ECD0000-0x0000026E1ECDA000-memory.dmp
memory/2948-219-0x0000026E26570000-0x0000026E26586000-memory.dmp
memory/5868-5-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/5868-9-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/5868-8-0x0000000000400000-0x000000000072E000-memory.dmp
memory/5868-138-0x0000000000400000-0x000000000072E000-memory.dmp