Analysis
- max time kernel
151s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 09:23
General
- Target ProjectLightningInstaller.exe
- Size 64.7MB
- Sample260718-lcsp7ae17l
- SHA256 0a00ca52d1a550e2062380f728cafd0ea4ca4c3baae8c6ad12b8e98088afa826
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2RGWQZFUJB.tmp\ProjectLightningInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-2RGWQZFUJB.tmp\ProjectLightningInstaller.tmp" /SL5="$4011A,66374051,842240,C:\Users\Admin\AppData\Local\Temp\ProjectLightningInstaller.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe"C:\Users\Admin\AppData\Roaming\ProjectLightning\Project Lightning.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
ProjectLightningInstaller.tmp
Newtonsoft.Json.dll
Project Lightning.exe
Project Lightning.exe.config
ReusableTasks.dll
System.Runtime.CompilerServices.Unsafe.dll
WpfAnimatedGif.dll
emerald_inferno.mp4
promo1.png
promo2.png
promo3.png
promo4.png
promo5.png
promo6.png
promo7.png
promo8.png
promo9.png
sponsors.txt
steam-force-sponsor.png
memory/756-264-0x0000000006380000-0x000000000638C000-memory.dmp
memory/756-310-0x0000000010990000-0x00000000109B2000-memory.dmp
memory/756-272-0x0000000008680000-0x000000000869C000-memory.dmp
memory/756-271-0x00000000733E0000-0x0000000073B9C000-memory.dmp
memory/756-286-0x000000000BA10000-0x000000000BAC2000-memory.dmp
memory/756-287-0x000000000BAD0000-0x000000000BB46000-memory.dmp
memory/756-270-0x0000000007AD0000-0x0000000007AD8000-memory.dmp
memory/756-292-0x000000000B950000-0x000000000B960000-memory.dmp
memory/756-291-0x000000000B950000-0x000000000B960000-memory.dmp
memory/756-290-0x000000000B950000-0x000000000B960000-memory.dmp
memory/756-289-0x000000000B950000-0x000000000B960000-memory.dmp
memory/756-294-0x000000000B950000-0x000000000B960000-memory.dmp
memory/756-293-0x000000000B950000-0x000000000B960000-memory.dmp
memory/756-266-0x00000000733E0000-0x0000000073B9C000-memory.dmp
memory/756-307-0x0000000007910000-0x0000000007918000-memory.dmp
memory/756-308-0x000000000F520000-0x000000000F55E000-memory.dmp
memory/756-309-0x000000000F510000-0x000000000F51E000-memory.dmp
memory/756-280-0x000000000AFF0000-0x000000000B178000-memory.dmp
memory/756-311-0x00000000109C0000-0x00000000109DE000-memory.dmp
memory/756-265-0x0000000007190000-0x00000000071AA000-memory.dmp
memory/756-328-0x00000000733E0000-0x0000000073B9C000-memory.dmp
memory/756-327-0x00000000733E0000-0x0000000073B9C000-memory.dmp
memory/756-326-0x00000000733F2000-0x00000000733F3000-memory.dmp
memory/756-258-0x0000000000E90000-0x0000000001940000-memory.dmp
memory/756-257-0x00000000733F2000-0x00000000733F3000-memory.dmp
memory/756-324-0x00000000108E0000-0x00000000108F0000-memory.dmp
memory/1496-23-0x00000000006D0000-0x00000000007AD000-memory.dmp
memory/1496-260-0x00000000006D0000-0x00000000007AD000-memory.dmp
memory/1496-1-0x00000000006D0000-0x00000000007AD000-memory.dmp
memory/3044-24-0x0000000000B00000-0x0000000000F6A000-memory.dmp
memory/3044-25-0x0000000003270000-0x0000000003271000-memory.dmp
memory/3044-6-0x0000000003270000-0x0000000003271000-memory.dmp
memory/3044-259-0x0000000000B00000-0x0000000000F6A000-memory.dmp