Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 02:11
General
- Target Halo-HDMSoftware-2.10.0-20251217.exe
- Size 4.3MB
- Sample260723-cmjetsfc46
- SHA256 5980594ca4ddeab632c62839878b9e0565489fbd296adaf68862810b8e32fcfa
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halo-HDMSoftware-2.10.0-20251217.exe"C:\Users\Admin\AppData\Local\Temp\Halo-HDMSoftware-2.10.0-20251217.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1HHUG.tmp\Halo-HDMSoftware-2.10.0-20251217.tmp"C:\Users\Admin\AppData\Local\Temp\is-1HHUG.tmp\Halo-HDMSoftware-2.10.0-20251217.tmp" /SL5="$801EE,3701391,792576,C:\Users\Admin\AppData\Local\Temp\Halo-HDMSoftware-2.10.0-20251217.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\HaloDevMan\FIREWALL.bat" add"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall show rule name="HaloDevMan" verbose4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /I "C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="HaloDevMan" dir=in action=allow program="C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe" profile=any4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="HaloDevMan" dir=out action=allow program="C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe" profile=any4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe"C:\Program Files (x86)\HaloDevMan\HaloDevMan.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
FIREWALL.bat
HaloDevMan.INI
HaloDevMan.exe
HaloDevMan.ini
Halo-HDMSoftware-2.10.0-20251217.tmp
memory/440-32-0x0000000000400000-0x00000000006F1000-memory.dmp
memory/440-8-0x0000000000400000-0x00000000006F1000-memory.dmp
memory/440-9-0x0000000002800000-0x0000000002801000-memory.dmp
memory/440-34-0x0000000000400000-0x00000000006F1000-memory.dmp
memory/440-37-0x0000000000400000-0x00000000006F1000-memory.dmp
memory/440-5-0x0000000002800000-0x0000000002801000-memory.dmp
memory/964-41-0x00000000006A0000-0x000000000099E000-memory.dmp
memory/964-43-0x0000000005AF0000-0x0000000006094000-memory.dmp
memory/964-44-0x00000000053F0000-0x0000000005482000-memory.dmp
memory/964-52-0x00000000053C0000-0x00000000053CA000-memory.dmp
memory/4184-0-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4184-38-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4184-7-0x0000000000400000-0x00000000004CF000-memory.dmp