Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 12:14
General
- Target utorrent_installer.exe
- Size 2.1MB
- Sample260722-pemthavalc
- SHA256 6f9b9d4f8153f48e80ddcfa6385ae6f921f52616309e060c23cf0ad483fd3597
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 9 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 64 IoCs
- Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-36X40D90PJ.tmp\utorrent_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-36X40D90PJ.tmp\utorrent_installer.tmp" /SL5="$A022C,902674,878080,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1ZT6X7AYKY.tmp\uTorrent.exe"C:\Users\Admin\AppData\Local\Temp\is-1ZT6X7AYKY.tmp\uTorrent.exe" /S /FORCEINSTALL 11100101011101003⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nst1422.tmp\utorrent.exe"C:\Users\Admin\AppData\Local\Temp\nst1422.tmp\utorrent.exe" /S /FORCEINSTALL 11100101011101004⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
107.png
108.png
109.png
uTorrent.exe
utorrent_installer.tmp
INetC.dll
System.dll
nsisFirewall.dll
utorrent.exe
memory/3344-17-0x00000000001A0000-0x0000000000285000-memory.dmp
memory/3344-0-0x00000000001A0000-0x0000000000285000-memory.dmp
memory/4712-41-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-51-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-34-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-29-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-38-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-39-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-42-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-27-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-25-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-47-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-46-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-48-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-50-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-33-0x0000000003D10000-0x0000000003E50000-memory.dmp
memory/4712-53-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-57-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-59-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-23-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-21-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-18-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-19-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/4712-89-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-91-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/4712-6-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/4712-99-0x00000000009E0000-0x0000000000E1F000-memory.dmp
memory/6108-102-0x0000000000400000-0x0000000000D17000-memory.dmp