Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 12:10
General
- Target Supremo 4.10.4.2204.exe
- Size 11.9MB
- Sample260710-pcfbmsa17n
- SHA256 a9591ae2c6a80347b8984475baef786927f4b6e5c86b9ce773c19c3402d828ec
Malware Config
Signatures
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 9 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Supremo 4.10.4.2204.exe"C:\Users\Admin\AppData\Local\Temp\Supremo 4.10.4.2204.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exe"C:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exe" "C:\Users\Admin\AppData\Local\Temp\Supremo 4.10.4.2204.exe" /wait 4676 /sysrun2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exeC:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Supremo 4.10.4.2204.exe"C:\Users\Admin\AppData\Local\Temp\Supremo 4.10.4.2204.exe" /wait 4676 /sysrun2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\SupremoRemoteDesktop\S-1-5-21-3797332335-34111092-3597280141-1000\SupremoHelper.exe"C:\Windows\Temp\SupremoRemoteDesktop\S-1-5-21-3797332335-34111092-3597280141-1000\SupremoHelper.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\Temp\SupremoRemoteDesktop\S-1-5-21-3797332335-34111092-3597280141-1000\SupremoHelper.exe"C:\Windows\Temp\SupremoRemoteDesktop\S-1-5-21-3797332335-34111092-3597280141-1000\SupremoHelper.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SupremoX.bg.sil
SupremoX.br.sil
SupremoX.bs.sil
SupremoX.ca.sil
SupremoX.cs.sil
SupremoX.de.sil
SupremoX.el.sil
SupremoX.en.sil
SupremoX.es.sil
SupremoX.et.sil
SupremoX.fr.sil
SupremoX.hi.sil
SupremoX.hr.sil
SupremoX.hu.sil
SupremoX.hy.sil
SupremoX.it.sil
SupremoX.ja.sil
SupremoX.lt.sil
SupremoX.nl.sil
SupremoX.no.sil
SupremoX.pl.sil
SupremoX.pt.sil
SupremoX.ro.sil
SupremoX.ru.sil
SupremoX.sl.sil
SupremoX.sv.sil
SupremoX.uk.sil
SupremoX.zh-Hans.sil
SupremoX.zh-Hant.sil
Settings.dat
SupremoSystem.exe
libcrypto-1_1.dll
libssl-1_1.dll
SupremoHelper.exe
openh264-win32.dll
memory/2436-59-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2444-63-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2812-67-0x0000000005660000-0x0000000005661000-memory.dmp
memory/2812-69-0x0000000005C40000-0x0000000005C41000-memory.dmp
memory/2812-139-0x0000000000400000-0x00000000037DE000-memory.dmp
memory/2812-135-0x0000000000400000-0x00000000037DE000-memory.dmp
memory/2812-132-0x0000000000400000-0x00000000037DE000-memory.dmp
memory/2812-65-0x0000000005650000-0x0000000005651000-memory.dmp
memory/2812-71-0x0000000005C50000-0x0000000005C51000-memory.dmp
memory/4676-9-0x0000000007170000-0x0000000007171000-memory.dmp
memory/4676-0-0x0000000000400000-0x00000000037DE000-memory.dmp
memory/4676-61-0x0000000000400000-0x00000000037DE000-memory.dmp
memory/4676-62-0x0000000000400000-0x00000000037DE000-memory.dmp
memory/4676-60-0x0000000000400000-0x00000000037DE000-memory.dmp
memory/4676-1-0x000000000040B000-0x000000000040C000-memory.dmp
memory/4676-2-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/4676-3-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/4676-5-0x0000000007150000-0x0000000007151000-memory.dmp
memory/4676-7-0x0000000007160000-0x0000000007161000-memory.dmp
memory/6032-129-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/6032-154-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-134-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-125-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/6032-138-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-127-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/6032-142-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-147-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-151-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-131-0x00000000054D0000-0x00000000054D1000-memory.dmp
memory/6032-158-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-162-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-166-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-169-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-173-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-178-0x00000000009F0000-0x0000000000E45000-memory.dmp
memory/6032-181-0x00000000009F0000-0x0000000000E45000-memory.dmp