57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.exe
Size 12.2MB
Sample260706-j2sqdabz2x
SHA256 57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08
MD5 a93c46155d45b14c0046377281872775
SHA1 cd7cb34703e766b28ae44557849400b2e45014a2
SHA512 4f2a50ddaf31359dfbce9b4841c8ba855dd42cb09648253ce9abcfec1f6571aec4cefd810cd315fd3eac989691568449dda82298fc0b36bb9bbc0ec8aae37b5f
SSDEEP 393216:cD6rk7jLh/gRUEN2IJ07iCChHsiWseOarN+o:RM4XNEi9tZal
TLSH
T1CFD62323B24E673EF47E55354A73AA40443FAE21A91B8CB796F41E0CCE394611D7EE06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6556	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp

Loads dropped DLL 3 IoCs

pid	Process
5148	regsvr32.exe
6660	regsvr32.exe
4816	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3036-1-0x0000000000B80000-0x0000000000C5F000-memory.dmp	innosetup
behavioral2/memory/3036-25-0x0000000000B80000-0x0000000000C5F000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6556	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp
6556	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp
5148	regsvr32.exe
5148	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6556	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 6556	3036	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.exe	91
PID 6556 wrote to memory of 5148	6556	57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp	92
PID 4680 wrote to memory of 6660	4680	regsvr32.exe	97
PID 4796 wrote to memory of 4816	4796	regsvr32.exe	99

C:\Users\Admin\AppData\Local\Temp\57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.exe
"C:\Users\Admin\AppData\Local\Temp\57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\is-LAQ9L.tmp\57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LAQ9L.tmp\57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp" /SL5="$4022E,11734167,848896,C:\Users\Admin\AppData\Local\Temp\57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6556
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\44d943c6_4528_4c43_bab4_e3bace8d4e3c.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5148

C:\Windows\System32\regsvr32.exe
regsvr32.exe
1⤵
PID:4192

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\44d943c6"_"4528"_"4c43"_"bab4"_"e3bace8d4e3c.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\regsvr32.exe
  /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\44d943c6"_"4528"_"4c43"_"bab4"_"e3bace8d4e3c.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6660

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\44d943c6"_"4528"_"4c43"_"bab4"_"e3bace8d4e3c.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\regsvr32.exe
  /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\44d943c6"_"4528"_"4c43"_"bab4"_"e3bace8d4e3c.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LAQ9L.tmp\57dae232eb671afd4fff507b4449b8dab20466e643a620f59bd268941491fc08.tmp
Size 3.5MB
SHA256 c3857abb9a6ff0f62d55c6c3de6892839b36e82b941d3e9afda2401ecea2883d
MD5 2fa79ed50d9f4bdd911a54c27079552e
SHA1 bd9b88842825187984beaf810d7893fb7bbc996d
SHA512 006ba783b7e8b770ccbbb36d1a5d281b12eae40e65f76462f7c4b84373c6b4c43231bf1aee989a2e6930ba2097462f9bce4706498ff9fa19d41d177376482173
SSDEEP 49152:544B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70azpkfb333n6:yIPp70wijepoGzgbAb3336
TLSH
T16F066C13F349653ED06B1A3B683F9294583F7A7029138C579BEC3A4C4E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44d943c6_4528_4c43_bab4_e3bace8d4e3c.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\44d943c6_4528_4c43_bab4_e3bace8d4e3c.dll
Size 4.5MB
SHA256 fcc294ef03c93d91b6ac9d93ca07aa641e283b373f712438392646ad0028635d
MD5 6f0fa98c500c4ab9c78b2f8888e2ab8c
SHA1 538ee7ccc162ff8e96cd76b0d5be0a16db07eaf8
SHA512 ae5fa0802e1674ffac7c72b9ec62a8cd08e2b017f6e14eb3130e54a8e1d0dc637ce311ca05a782dd4d90f37bc2883afaace6a38ef3527bf77be405d5985fb520
SSDEEP 98304:B9xTFj/XpKQtR7Ss5F/reoMEj5XEIMWTk8oOLdzwEj:B9xTFjPpKQtR7Ss5dNMEj5UIjTkszwEj
TLSH
T1A7267E10E5606875DE9B1530105FE33BE6305F24803ACAA7DF799EA4BBFF791A848607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3036-1-0x0000000000B80000-0x0000000000C5F000-memory.dmp

Download

memory/3036-25-0x0000000000B80000-0x0000000000C5F000-memory.dmp

Download

memory/5148-44-0x0000000074450000-0x000000007481C000-memory.dmp

Download

memory/5148-29-0x0000000074450000-0x000000007481C000-memory.dmp

Download

memory/6556-12-0x0000000004340000-0x0000000004480000-memory.dmp

Download

memory/6556-11-0x0000000004340000-0x0000000004480000-memory.dmp

Download

memory/6556-13-0x0000000004340000-0x0000000004480000-memory.dmp

Download

memory/6556-14-0x0000000004340000-0x0000000004480000-memory.dmp

Download

memory/6556-9-0x0000000004340000-0x0000000004480000-memory.dmp

Download

memory/6556-24-0x0000000000A00000-0x0000000000D9E000-memory.dmp

Download

memory/6556-8-0x0000000004340000-0x0000000004480000-memory.dmp

Download

memory/6556-10-0x0000000004340000-0x0000000004480000-memory.dmp

Download

memory/6556-6-0x00000000030B0000-0x00000000030B1000-memory.dmp

Download