Analysis
- user interaction
yes - max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
02/07/2026, 14:41
General
- Target DupePacket-Installer.exe
- Size 13.7MB
- Sample260702-r2txfadt4k
- SHA256 fcf00b82cd95f38a86d0f4841d4d9bb57823d571366bcd930ca989ca7bf46ba6
Malware Config
Signatures
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 28 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DupePacket-Installer.exe"C:\Users\Admin\AppData\Local\Temp\DupePacket-Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5JY9ZJSJ5C.tmp\DupePacket-Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-5JY9ZJSJ5C.tmp\DupePacket-Installer.tmp" /SL5="$5019A,13209219,882176,C:\Users\Admin\AppData\Local\Temp\DupePacket-Installer.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Client Runtime Proccess\main.exe"C:\Users\Admin\AppData\Roaming\Client Runtime Proccess\main.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DupePacket-Installer.tmp
VCRUNTIME140.dll
_socket.pyd
__init__.pyc
abc.pyc
__init__.pyc
_encoded_words.pyc
_parseaddr.pyc
_policybase.pyc
base64mime.pyc
charset.pyc
encoders.pyc
errors.pyc
feedparser.pyc
header.pyc
message.pyc
parser.pyc
quoprimime.pyc
utils.pyc
__init__.pyc
aliases.pyc
cp1252.pyc
utf_8.pyc
__init__.pyc
client.pyc
__init__.pyc
_abc.pyc
machinery.pyc
util.pyc
__init__.pyc
decoder.pyc
encoder.pyc
scanner.pyc
library.dat
library.zip
__init__.pyc
main.cp310-win_amd64.pyd
__init__.pyc
_common.pyc
_psutil_windows.pyd
_pswindows.pyc
pywintypes310.dll
__init__.pyc
select.pyd
INSTALLER
is-LZPC3839JW.tmp
is-62BQYSW1RT.tmp
is-BPGO6ENX04.tmp
is-SRP1CE2JHJ.tmp
__init__.pyc
exceptions.pyc
__init__.pyc
parse.pyc
is-0PAZPY9Q1A.tmp
is-C4YER3X7WE.tmp
win32crypt.pyd
main.exe
python3.dll
python310.dll
vcruntime140_1.dll
memory/2672-2899-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/2672-2910-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2926-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2924-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2898-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2901-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2903-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2905-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2907-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-6-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/2672-2912-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2914-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2916-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2918-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2920-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/2672-2922-0x0000000000F50000-0x00000000012FA000-memory.dmp
memory/6064-0-0x0000000000DB0000-0x0000000000E97000-memory.dmp
memory/6064-2897-0x0000000000DB0000-0x0000000000E97000-memory.dmp