Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 03:10
General
- Target AMD_Radeon-outbyte-driver-updater.exe
- Size 22.3MB
- Sample260706-dpfbmac18l
- SHA256 168655fb1d8a0318f9ff059e30b3b32679e8e8e4062018e9ce9a0731efd7d7e4
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 23 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AMD_Radeon-outbyte-driver-updater.exe"C:\Users\Admin\AppData\Local\Temp\AMD_Radeon-outbyte-driver-updater.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-14168781.tmp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\is-14168781.tmp\Installer.exe" /spid:5424 /splha:366764162⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AxComponentsRTL.bpl
AxComponentsVCL.bpl
CommonForms.Site.dll
main.ini
DriverUpdater.exe
GoogleAnalyticsHelperIV.dll
Installer.exe
InstallerUtils.dll
enu.lng
Localizer.dll
OxComponentsRTL.bpl
SetupHelper.dll
rtl250.bpl
vcl250.bpl
vclimg250.bpl
memory/3064-65-0x0000000007A50000-0x0000000007A70000-memory.dmp
memory/3064-126-0x00000000019D0000-0x00000000022CF000-memory.dmp
memory/3064-60-0x00000000019D0000-0x00000000022CF000-memory.dmp
memory/3064-55-0x0000000000E10000-0x0000000000F99000-memory.dmp
memory/3064-82-0x0000000007C50000-0x0000000007C84000-memory.dmp
memory/3064-87-0x0000000007E50000-0x0000000008193000-memory.dmp
memory/3064-93-0x0000000008780000-0x00000000087A0000-memory.dmp
memory/3064-92-0x0000000008780000-0x00000000087A0000-memory.dmp
memory/3064-91-0x00000000085E0000-0x0000000008639000-memory.dmp
memory/3064-57-0x0000000000FA0000-0x00000000019C6000-memory.dmp
memory/3064-278-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-78-0x0000000007BC0000-0x0000000007C06000-memory.dmp
memory/3064-66-0x0000000007A50000-0x0000000007A70000-memory.dmp
memory/3064-266-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-254-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-123-0x0000000000DB0000-0x0000000000E0A000-memory.dmp
memory/3064-122-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-130-0x00000000085E0000-0x0000000008639000-memory.dmp
memory/3064-128-0x0000000007C50000-0x0000000007C84000-memory.dmp
memory/3064-129-0x0000000007E50000-0x0000000008193000-memory.dmp
memory/3064-125-0x0000000000FA0000-0x00000000019C6000-memory.dmp
memory/3064-53-0x0000000000DB0000-0x0000000000E0A000-memory.dmp
memory/3064-124-0x0000000000E10000-0x0000000000F99000-memory.dmp
memory/3064-127-0x0000000007BC0000-0x0000000007C06000-memory.dmp
memory/3064-121-0x0000000050000000-0x00000000502D3000-memory.dmp
memory/3064-120-0x0000000000400000-0x000000000067C000-memory.dmp
memory/3064-134-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-144-0x0000000000400000-0x000000000067C000-memory.dmp
memory/3064-151-0x0000000007BC0000-0x0000000007C06000-memory.dmp
memory/3064-146-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-156-0x0000000000400000-0x000000000067C000-memory.dmp
memory/3064-157-0x0000000050000000-0x00000000502D3000-memory.dmp
memory/3064-158-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-170-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-182-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-194-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-206-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-218-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-230-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/3064-242-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/5424-119-0x0000000000400000-0x0000000000484000-memory.dmp
memory/5424-5-0x00000000024C0000-0x0000000002803000-memory.dmp
memory/5424-11-0x0000000007100000-0x00000000071F2000-memory.dmp