Analysis
- user interaction
yes - max time kernel
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 09:58
General
- Target syncfusionessentialdocumentsdkwebinstaller.exe
- Size 6.1MB
- Sample260623-lzzf9ab16w
- SHA256 2d532e794b6bf2cc7bc7198264d735c5e0bb3dc4408ed5a91ffd144435204e5a
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\syncfusionessentialdocumentsdkwebinstaller.exe"C:\Users\Admin\AppData\Local\Temp\syncfusionessentialdocumentsdkwebinstaller.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9U115M4AAY.tmp\syncfusionessentialdocumentsdkwebinstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-9U115M4AAY.tmp\syncfusionessentialdocumentsdkwebinstaller.tmp" /SL5="$502C6,5203707,1207808,C:\Users\Admin\AppData\Local\Temp\syncfusionessentialdocumentsdkwebinstaller.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\Syncfusion Essential Studio for Document SDK 33.2.3\syncfusionessentialdocumentsdkwebinstaller_33.2.3.exe"C:\ProgramData\Package Cache\Syncfusion Essential Studio for Document SDK 33.2.3\syncfusionessentialdocumentsdkwebinstaller_33.2.3" "C:\Users\Admin\AppData\Local\Temp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\dotnet\dotnet.exe"dotnet" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"dotnet" workload list4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"dotnet" workload list4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"dotnet" workload list4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Syncfusion.Installer.SystemHelper.dll
Syncfusion.WebInstaller.UI.dll
syncfusionessentialdocumentsdkwebinstaller_33.2.3.exe
syncfusionessentialdocumentsdkwebinstaller_33.2.3.exe.config
syncfusionessentialdocumentsdkwebinstaller.tmp
memory/2292-6-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/2292-102-0x0000000000990000-0x0000000000E20000-memory.dmp
memory/2292-98-0x0000000000990000-0x0000000000E20000-memory.dmp
memory/2292-97-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/2724-80-0x0000000006660000-0x0000000006668000-memory.dmp
memory/2724-94-0x000000000A270000-0x000000000A302000-memory.dmp
memory/2724-79-0x0000000006690000-0x00000000066C2000-memory.dmp
memory/2724-82-0x0000000006670000-0x000000000667E000-memory.dmp
memory/2724-81-0x0000000006710000-0x000000000674E000-memory.dmp
memory/2724-104-0x0000000073240000-0x00000000739FC000-memory.dmp
memory/2724-88-0x0000000006750000-0x0000000006774000-memory.dmp
memory/2724-77-0x00000000060B0000-0x00000000065AC000-memory.dmp
memory/2724-91-0x0000000006D60000-0x0000000006D7C000-memory.dmp
memory/2724-92-0x0000000006D80000-0x0000000006D88000-memory.dmp
memory/2724-93-0x000000000A830000-0x000000000ADEA000-memory.dmp
memory/2724-78-0x0000000073240000-0x00000000739FC000-memory.dmp
memory/2724-95-0x000000000A520000-0x000000000A596000-memory.dmp
memory/2724-71-0x0000000073252000-0x0000000073253000-memory.dmp
memory/2724-74-0x0000000073240000-0x00000000739FC000-memory.dmp
memory/2724-72-0x0000000000210000-0x00000000005CC000-memory.dmp
memory/2724-99-0x0000000073252000-0x0000000073253000-memory.dmp
memory/2724-100-0x0000000073240000-0x00000000739FC000-memory.dmp
memory/3056-96-0x0000000000900000-0x0000000000A35000-memory.dmp
memory/3056-103-0x0000000000900000-0x0000000000A35000-memory.dmp
memory/3056-1-0x0000000000900000-0x0000000000A35000-memory.dmp