Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 05:09
General
- Target 431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582.exe
- Size 8.6MB
- Sample260723-ftmyda1erc
- SHA256 431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 19 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582.exe"C:\Users\Admin\AppData\Local\Temp\431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2Q8GQ.tmp\431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582.tmp"C:\Users\Admin\AppData\Local\Temp\is-2Q8GQ.tmp\431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582.tmp" /SL5="$B0060,8130455,799744,C:\Users\Admin\AppData\Local\Temp\431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SUPRO1.0\SUPRO.exe"C:\Program Files (x86)\SUPRO1.0\SUPRO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ControlzEx.dll
GalaSoft.MvvmLight.dll
HandyControl.dll
Lierda.WPFHelper.dll
MahApps.Metro.dll
MaterialDesignColors.dll
MaterialDesignThemes.MahApps.dll
MaterialDesignThemes.Wpf.dll
NPOI.dll
CN.xaml
EN.xaml
MachineData.xls
SUPRO.exe
SUPRO.exe.config
System.Windows.Interactivity.dll
log4net.dll
431d7dedc5aa87e48e0ef38cc450ad0f2203dd22b06344386e7c9548b8b53582.tmp
memory/3188-249-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/3188-0-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/3188-7-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/3244-271-0x000002215EDA0000-0x000002215EDA8000-memory.dmp
memory/3244-240-0x000002215EC00000-0x000002215ECBA000-memory.dmp
memory/3244-237-0x000002215E950000-0x000002215E960000-memory.dmp
memory/3244-236-0x0000022144F80000-0x0000022144F88000-memory.dmp
memory/3244-234-0x0000022144FD0000-0x0000022145016000-memory.dmp
memory/3244-247-0x000002215F500000-0x000002215FAF8000-memory.dmp
memory/3244-281-0x000002215E590000-0x000002215E6DE000-memory.dmp
memory/3244-239-0x000002215EAB0000-0x000002215EBFE000-memory.dmp
memory/3244-232-0x0000022143350000-0x0000022143422000-memory.dmp
memory/3244-262-0x000002215EAA0000-0x000002215EAA8000-memory.dmp
memory/3244-279-0x000002215E950000-0x000002215E960000-memory.dmp
memory/3244-253-0x000002215EA50000-0x000002215EA62000-memory.dmp
memory/3244-277-0x000002215E590000-0x000002215E6DE000-memory.dmp
memory/3244-255-0x000002215EA70000-0x000002215EA7E000-memory.dmp
memory/3244-256-0x000002215EA80000-0x000002215EA8A000-memory.dmp
memory/3244-257-0x000002215EA90000-0x000002215EA98000-memory.dmp
memory/3244-278-0x000002215E950000-0x000002215E960000-memory.dmp
memory/3244-259-0x000002215EF40000-0x000002215EF72000-memory.dmp
memory/3244-243-0x000002215EDE0000-0x000002215EEF2000-memory.dmp
memory/3244-261-0x000002215EDD0000-0x000002215EDE0000-memory.dmp
memory/3244-251-0x000002215ECC0000-0x000002215ED0C000-memory.dmp
memory/3244-241-0x000002215E950000-0x000002215E960000-memory.dmp
memory/3244-276-0x000002215E950000-0x000002215E960000-memory.dmp
memory/3244-264-0x000002215FB00000-0x000002215FD08000-memory.dmp
memory/3244-266-0x000002215ED60000-0x000002215ED68000-memory.dmp
memory/3244-267-0x000002215ED70000-0x000002215ED78000-memory.dmp
memory/3244-269-0x000002215ED80000-0x000002215ED88000-memory.dmp
memory/3244-270-0x000002215ED90000-0x000002215ED98000-memory.dmp
memory/3244-275-0x000002215F3C0000-0x000002215F3CE000-memory.dmp
memory/3244-272-0x000002215E950000-0x000002215E960000-memory.dmp
memory/3244-273-0x000002215F3B0000-0x000002215F3B8000-memory.dmp
memory/3244-274-0x000002215F400000-0x000002215F438000-memory.dmp
memory/4836-9-0x0000000000850000-0x0000000000851000-memory.dmp
memory/4836-5-0x0000000000850000-0x0000000000851000-memory.dmp
memory/4836-8-0x0000000000400000-0x000000000070C000-memory.dmp
memory/4836-11-0x0000000000400000-0x000000000070C000-memory.dmp
memory/4836-227-0x0000000000400000-0x000000000070C000-memory.dmp
memory/4836-248-0x0000000000400000-0x000000000070C000-memory.dmp