Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 18:16
General
- Target RempahSoundPilot-Setup-0.1.0.exe
- Size 136KB
- Sample260718-wwqeaacy8w
- SHA256 0a6a28ed3cad81c9257d35956700b4cdddc2c3ec495ea0965a7e897c982a4283
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RempahSoundPilot-Setup-0.1.0.exe"C:\Users\Admin\AppData\Local\Temp\RempahSoundPilot-Setup-0.1.0.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Rempah SoundPilot\RempahSoundPilot.exe"C:\Program Files\Rempah SoundPilot\RempahSoundPilot.exe" --initialize2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Rempah SoundPilot\RempahSoundPilot.exe"C:\Program Files\Rempah SoundPilot\RempahSoundPilot.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Rempah SoundPilot\RempahSoundPilot.exe"C:\Program Files\Rempah SoundPilot\RempahSoundPilot.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RempahSoundPilot.exe
RempahSoundPilot.exe.config
rempah-soundpilot.log
rempah-soundpilot.log
rempah-soundpilot.settings.json.tmp
memory/3820-21-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-0-0x00007FF82623F000-0x00007FF826240000-memory.dmp
memory/3820-15-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-6-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-66-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-64-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-2-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-38-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-39-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp
memory/3820-1-0x0000000000F30000-0x0000000000F58000-memory.dmp
memory/4556-46-0x000000001D1F0000-0x000000001D1F8000-memory.dmp
memory/4556-48-0x000000001D260000-0x000000001D26E000-memory.dmp
memory/4556-47-0x000000001D2A0000-0x000000001D2DE000-memory.dmp
memory/5608-23-0x000000001B710000-0x000000001B74C000-memory.dmp
memory/5608-22-0x000000001B580000-0x000000001B592000-memory.dmp
memory/5608-20-0x0000000000B10000-0x0000000000B34000-memory.dmp