Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/06/2026, 16:20
General
- Target BESTCOMSPlus_51201_Installer.exe
- Size 274.5MB
- Sample260623-tth63set4x
- SHA256 d0b29db1002941db89d66fc843e96b6c1b775aca667f75787dfe1f233f471164
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 30 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BESTCOMSPlus_51201_Installer.exe"C:\Users\Admin\AppData\Local\Temp\BESTCOMSPlus_51201_Installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sfx.{AAC5564A-E86C-4246-90DF-537DDEE99A0C}.dir\Gui.exeGui.exe en2⤵
- Enumerates connected drives
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Gui.exe
Gui.exe.config
IntermediateBootstrapper.dll
Package_x64.msi
SharpSetup.WinForms.dll
SharpSetup.dll
SharpSetup.WinForms.resources.dll
SharpSetup.resources.dll
memory/3528-0-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/3528-36-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/3708-24-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3708-31-0x000000001C900000-0x000000001CA1A000-memory.dmp
memory/3708-32-0x000000001B3D0000-0x000000001B3E0000-memory.dmp
memory/3708-29-0x000000001C5C0000-0x000000001C6EA000-memory.dmp
memory/3708-34-0x000000001C5B0000-0x000000001C5C0000-memory.dmp
memory/3708-27-0x000000001B3D0000-0x000000001B3E0000-memory.dmp
memory/3708-26-0x00000000024F0000-0x0000000002536000-memory.dmp
memory/3708-37-0x000000001B3D0000-0x000000001B3E0000-memory.dmp
memory/3708-38-0x000000001B3D0000-0x000000001B3E0000-memory.dmp