Analysis
- user interaction
yes - max time kernel
48s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/07/2026, 15:57
General
- Target setup.exe
- Size 3.0MB
- Sample260712-teekcaew9v
- SHA256 1f2a3f26eadb7b4e7e1ef4efc18e59c7278f4fe4dbbd52c2a90c4b0f45ccbb4f
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 16 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H1L23.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-H1L23.tmp\setup.tmp" /SL5="$6023C,2517808,254976,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4UTES.tmp\srep64.exesrep64 -d -mem30p -s --3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Games\RimWorld\RimWorldWin64.exe"C:\Games\RimWorld\RimWorldWin64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Games\RimWorld\UnityCrashHandler64.exe"C:\Games\RimWorld\UnityCrashHandler64.exe" --attach 2432 26312110940162⤵
- Executes dropped EXE
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4e8 0x4d41⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
mono-2.0-bdwgc.dll
Compat.browser
DefaultWsdlHelpGenerator.aspx
config
RimWorldWin64.exe
UnityEngine.AIModule.dll
UnityEngine.ARModule.dll
UnityEngine.AccessibilityModule.dll
UnityEngine.AndroidJNIModule.dll
UnityEngine.AnimationModule.dll
UnityEngine.AssetBundleModule.dll
UnityEngine.AudioModule.dll
UnityEngine.ClothModule.dll
UnityEngine.ClusterInputModule.dll
UnityEngine.ClusterRendererModule.dll
UnityEngine.ContentLoadModule.dll
UnityEngine.CoreModule.dll
UnityEngine.CrashReportingModule.dll
UnityEngine.DSPGraphModule.dll
UnityEngine.DirectorModule.dll
UnityEngine.GIModule.dll
UnityEngine.GameCenterModule.dll
UnityEngine.GridModule.dll
UnityEngine.HotReloadModule.dll
UnityEngine.IMGUIModule.dll
UnityEngine.ImageConversionModule.dll
UnityEngine.InputLegacyModule.dll
UnityEngine.InputModule.dll
UnityEngine.JSONSerializeModule.dll
UnityEngine.LocalizationModule.dll
UnityEngine.NVIDIAModule.dll
UnityEngine.ParticleSystemModule.dll
UnityEngine.PerformanceReportingModule.dll
UnityEngine.PhysicsModule.dll
UnityEngine.dll
mscorlib.dll
unity default resources
RuntimeInitializeOnLoads.json
ScriptingAssemblies.json
app.info
boot.config
globalgamemanagers
UnityCrashHandler64.exe
UnityPlayer.dll
UnityPlayer.dll
CLS-MSC.dll
CLS-srep.dll
ISDone.dll
_iscrypt.dll
callbackctrl.dll
cls-bpk.dll
cls-lolz.dll
facompress.dll
facompress_mt.dll
srep64.exe
unarc.dll
wintb.dll
setup.tmp
memory/1884-4366-0x0000000000400000-0x0000000000449000-memory.dmp
memory/1884-40-0x0000000000400000-0x0000000000449000-memory.dmp
memory/1884-0-0x0000000000400000-0x0000000000449000-memory.dmp
memory/2432-4414-0x00000265E9790000-0x00000265E9A7C000-memory.dmp
memory/2432-4421-0x00000265E9790000-0x00000265E9A7C000-memory.dmp
memory/4280-2600-0x0000000000400000-0x000000000054C000-memory.dmp
memory/4280-94-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/4280-92-0x0000000000400000-0x000000000054C000-memory.dmp
memory/4280-96-0x000000000A340000-0x000000000A399000-memory.dmp
memory/4280-95-0x0000000061080000-0x0000000061115000-memory.dmp
memory/4280-41-0x0000000000400000-0x000000000054C000-memory.dmp
memory/4280-43-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/4280-44-0x0000000000820000-0x0000000000821000-memory.dmp
memory/4280-42-0x0000000003380000-0x00000000033F7000-memory.dmp
memory/4280-77-0x0000000073F40000-0x0000000073F47000-memory.dmp
memory/4280-93-0x0000000003380000-0x00000000033F7000-memory.dmp
memory/4280-4365-0x0000000000400000-0x000000000054C000-memory.dmp
memory/4280-2613-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/4280-19-0x0000000003380000-0x00000000033F7000-memory.dmp
memory/4280-2610-0x0000000003380000-0x00000000033F7000-memory.dmp
memory/4280-6-0x0000000000820000-0x0000000000821000-memory.dmp
memory/5812-4253-0x0000000000400000-0x00000000004A5000-memory.dmp
memory/5812-97-0x0000000000400000-0x00000000004A5000-memory.dmp