Analysis
- user interaction
yes - max time kernel
152s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 00:28
General
- Target Mastering The Mix bundle v6.5.0.exe
- Size 181.8MB
- Sample260702-asjxfaav21
- SHA256 08513dde6514376d4c7f26184d06a6657938c45aea69900db30177623a7832d9
- MD5 d68a09fbffe6121d3110829005c307f6
- SHA1 c79b3a51308c7dd94e883a40eca19187236d74dc
- SHA512 564f5940b309d925853b9f4f2f5b36cfdab4a3c0c58460ebb65b9a8c87a5804c03a4c7baad5a84da7d4100b33d4713776813d1a88dc47cfb8515b9103b538767
- SSDEEP 3145728:Gd2QUCE0qrpu0EwmH5xH+67ybq4oVGRByCJT65Y+1K5AV392cll7Jemuy:9SZAplgHJ7IRA8TgYGK5E39xl0y
- TLSH T1C798332A716F517DC0AD55318EB7D6B9583A3F4465328C2F82E4BC0DCB2B49D093F9A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5580 Mastering The Mix bundle v6.5.0.tmp - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mastering The Mix bundle v6.5.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mastering The Mix bundle v6.5.0.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/5744-0-0x0000000000400000-0x00000000004F0000-memory.dmp innosetup behavioral1/memory/5744-8-0x0000000000400000-0x00000000004F0000-memory.dmp innosetup - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5744 wrote to memory of 5580 5744 Mastering The Mix bundle v6.5.0.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mastering The Mix bundle v6.5.0.exe"C:\Users\Admin\AppData\Local\Temp\Mastering The Mix bundle v6.5.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\is-M81FT.tmp\Mastering The Mix bundle v6.5.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-M81FT.tmp\Mastering The Mix bundle v6.5.0.tmp" /SL5="$502CA,189452740,925696,C:\Users\Admin\AppData\Local\Temp\Mastering The Mix bundle v6.5.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5580
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-M81FT.tmp\Mastering The Mix bundle v6.5.0.tmp
- Size 3.6MB
- SHA256 d43657c80600933854ba40122b682e46dbe29f1adb96de641d0562eb13843c82
- MD5 676f4db7f70630a4a93279d1b4dd56d3
- SHA1 da88a202fb0639fc8723fe3b0b49e04760a8d4c3
- SHA512 ba959cbb1c1a3aad0ee2b410801176fba7139d7a2727ebcfc76fb36a1dcdd00b019ee33d8e1bb19910900993d3421b6a2534bebc832021a42a3a1843c07eeb98
- SSDEEP 49152:zrHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/y333TX1:zrnwboEuM4mQiEC0DQ333TF
- TLSH T14C065B13F244A93ED06B3A354637C65499377B626A2ADC176BF82D4C8F361403E3B786
- MD5 SHA1 SHA512 SSDEEP TLSH