Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 12:18
Behavioral task
behavioral1
Sample
Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
WebDriver.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
WebDriver.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral5
Sample
설치방법.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
설치방법.html
Resource
win11ltsc2024-20260629-en
General
- Target Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe
- Size 15.8MB
- Sample260701-pg3mqsdy9q
- SHA256 ec8da4b7c0febef3c1037054495363ae4a721be552f48772da50db13f7a0e673
- MD5 3f0553ffdda8b20c178268542023abab
- SHA1 4c670bf9daa133f4e23c73d7a1bf2b05b6318a04
- SHA512 9adcd52d3cfabe0de2daae9d21f31b629c602eb1f1df6af16c877340434a9ce8db5160c699eb728897125953af570420b2f00806f78965d7020669d19a37f223
- SSDEEP 393216:hnwN0QuzAr9sMbYxdX0/zMKhfa+Wmi6zFgzq9P:hnwNluG9Cm/HhM0zF1P
- TLSH T1FEF6334162D209B6EED9AE31C06BC8548F12BD7D5AE20D476E7AF84C1EF03562DB1327
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5584 Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp 2328 BxlWinDriver_Setup_x64.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/2916-0-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral2/memory/2916-9-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral2/memory/2916-335-0x0000000000400000-0x0000000000428000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5584 Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp 5584 Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5584 Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2328 BxlWinDriver_Setup_x64.exe 2328 BxlWinDriver_Setup_x64.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2916 wrote to memory of 5584 2916 Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe 88 PID 5584 wrote to memory of 2328 5584 Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe"C:\Users\Admin\AppData\Local\Temp\Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\is-56A5T.tmp\Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-56A5T.tmp\Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp" /SL5="$80212,16120505,121344,C:\Users\Admin\AppData\Local\Temp\Software_SRP-330II_332II_Windows_Driver_V1.2.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\BIXOLON Printer Driver\SRP-330II_332II\BxlWinDriver_Setup_x64.exe"C:\BIXOLON Printer Driver\SRP-330II_332II\BxlWinDriver_Setup_x64.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2328
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\BIXOLON Printer Driver\SRP-330II_332II\BxlWinDriver_Setup_x64.exe
- Size 2.8MB
- SHA256 c57de78e3c61d744ac27513264cd7f2e5b0466b8732d09a694d226e232a672d6
- MD5 147df4aca58422d17b8d9016ba0912e1
- SHA1 f9d4cc6646c9b566473571ddc5320312436c6f5f
- SHA512 3b7f8cc186a2c130522a76c9d87d7896727ea03bdfbef74874ac7a9e36c38bbec05151cf967b6db6322f761c9ef4d3c81c4d8836af23c03ece29985fe129e963
- SSDEEP 49152:alz8eIeP2DzpX3r1bJ+uEBeaKKJGZ73ZD/30zoJf5cBFkAII:MdwBr1PEqkzyf5czk
- TLSH T104D53A59A6F840E6D053D5BAC9168E4BD6F23C510B30C38F41527BEA5FB33A28D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\BIXOLON Printer Driver\SRP-330II_332II\bxlwindriver_setup.ini
- Size 2KB
- SHA256 e7baddf95f1141ceb3f0b0ae80a7e71e75dc97ae2dd8ca0b3d72ded6a3a88cc1
- MD5 43096f29439e4127c6ee39df744d0723
- SHA1 8aa9481a756900d0be1da3fea9d1dfee52e742d9
- SHA512 b6aa12fc55a843034cb85681a5242a0e933bf9b63f7c60e61fbf319b350136408358e22e650c1b1d9c4edac2d65bdcfd924f7ac1b9f3d35e4cecf1d4c0b2ea09
- TLSH T1E6418CB6E98180F56702C50A6478E9B2A0DD24AFDADC72324F6EF29025B732740BDD18
- MD5 SHA1 SHA512 TLSH
- Path C:\Temp\BxlWinDriver_Setup_x64.log
- Size 14KB
- SHA256 eebdda629a89d42737e8a7aa9eccdcbb67ebc0f34662f59dab588d62d28ef40d
- MD5 856e385dabe0835e3a14c79edc7f21a1
- SHA1 43b4e4ef9650d529c74b014e3f63b1c6c9d2298e
- SHA512 c0bb6776c984045917d843699b43661a9d8319c8e9d7fb077e61b724462fce218d28ec967fbb480998ef354c426706158bd7ed7716a638b5437d87ff9ae29ebd
- SSDEEP 384:4C5L5Es50lu5XGwgnjhyYApp+g/G/61wEMOyPpGEm7kq+ibXN+mF:7VhZXGwgnjhyh
- TLSH T14862E47733EE609DF1F3D653AAF7702686737C571632EC2D2040631907AA88466E0B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-56A5T.tmp\Software_SRP-330II_332II_Windows_Driver_V1.2.0.tmp
- Size 1.1MB
- SHA256 821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
- MD5 90fc739c83cd19766acb562c66a7d0e2
- SHA1 451f385a53d5fed15e7649e7891e05f231ef549a
- SHA512 4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
- SSDEEP 24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
- TLSH T198453A22A3D24437D5732F759C6BC2946C367E202EA4E54A7EF99E0C0E39B41BD35392
- MD5 SHA1 SHA512 SSDEEP TLSH