Overview

overview

7

Static

static

7

ISL AlwaysOn.exe

windows10-2004-x64

5

ISL AlwaysOn.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 05:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ISL AlwaysOn.exe
  • Size 678KB
  • Sample260727-fwthyahc73
  • SHA256 1adc9aa12692d52d81361814c230e81979b7024d5528807429519aa2a6e4b95f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoveryinstaller

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 15 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 62 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ISL AlwaysOn.exe
    "C:\Users\Admin\AppData\Local\Temp\ISL AlwaysOn.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1785129233_628_4988_1772425183\ISLAlwaysOn_5_0_2551_117.exe
      ISLAlwaysOn_5_0_2551_117.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOnCheck.exe
        "C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOnCheck.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe
          "C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4164
          • C:\Users\Admin\AppData\Local\Temp\is-51VN5.tmp\ISLAlwaysOn_setup.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-51VN5.tmp\ISLAlwaysOn_setup.tmp" /SL5="$801C0,9677807,780800,C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
            5⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3584
            • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
              "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe" service_install
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1516
            • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
              "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe" save_send_prefix /SL5="$801C0,9677807,780800,C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2284
            • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
              "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe" /setup /SL5="$801C0,9677807,780800,C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
              6⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              PID:5184
  • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnService.exe
    "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
      "ISLAlwaysOn.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnTray.exe
        i tray
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:6000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DefaultConfiguration.ini
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\DefaultConfiguration.ini
        • Size 92B
        • SHA256 25c3e9036b7ac1ada5dc19dcf8b8064fae6df61b3eea323f839ce7c17a2bcdd8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ISLAlwaysOn.exe
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
        • Size 13.6MB
        • SHA256 c65c9bc5a3afbd6e3df4bf8e8801af386c6cc31ccea60148794bb108e7e01ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOnService.exe
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnService.exe
        • Size 174KB
        • SHA256 6ae9ba20a701af82bb71df4c3ba76377b91df68df3a7f1589e45f2ed245c5ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOnTray.exe
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnTray.exe
        • Size 1.2MB
        • SHA256 41a8b60d4d582073d2bb64f9aa0bc598e060a90cf4894001df88751c9ff8f55d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StaticConfiguration.ini
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\StaticConfiguration.ini
        • Size 287B
        • SHA256 e359b65b3f8831be609e4f2f8ddc78ed4ad99dd1b03d866ee9152759a1eb72ab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aon_gui.out
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\aon_gui.out
        • Size 7KB
        • SHA256 8fa4a5d2dd729ea2fb2fa49e7084df8ffb692c4b1140f8d11f802ff28d0bb90a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aon_service.out
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\aon_service.out
        • Size 15KB
        • SHA256 d1c59fca6cc6930b1ed047b62d7c3a0e917bcfac159d7e1c991641c6ec5c9737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        startup_info.txt
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\startup_info.txt
        • Size 76B
        • SHA256 ed4303ac4e8ad6be62c3f37eea84ce714614827c651d4c3c482142d2bcc3dc02
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tray
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\status\tray
        • Size 22B
        • SHA256 faa3d32919160f8075fff56b4d45aa52fba053cec8960a00560852bd7ed25d62
        • MD5 SHA1 SHA512
        Submit Download

        translations
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\translations\translations
        • Size 721KB
        • SHA256 aa323a18945f8db860052e6872d9c27fb63d0014ab5bab8ef5bfc0ddda14201d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOnCheck.exe
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOnCheck.exe
        • Size 17KB
        • SHA256 e0b828f2aed90b21fcf9f5fcc965a62ade229b3fcb8a42c4a8e0f62e3bc06b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_setup.exe
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe
        • Size 10.2MB
        • SHA256 bcac6f8ef488beaf38a2c2108771ea5393106921528e7a561f46d4b076ead328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLNetworkStart.dll
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\ISLNetworkStart.dll
        • Size 1.5MB
        • SHA256 242d1b8f110af36148211de21cbb93a825b42e27c1b1eaeee05bcd40e037209c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_5_0_2551_117.exe
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1785129233_628_4988_1772425183\ISLAlwaysOn_5_0_2551_117.exe
        • Size 10.5MB
        • SHA256 ae557eebb0f84b419559388c5b4af55d6f54559eee8cf63b7016b8c4518bc406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_5_0_2551_117.exe.extra
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1785129233_628_4988_1772425183\ISLAlwaysOn_5_0_2551_117.exe.extra
        • Size 637B
        • SHA256 e9cb9a7eddb3d7fa610cba0fcec9f4e7669e3c35b5fa0139428fc5492271d592
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        isl_network_start.log
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log
        • Size 5KB
        • SHA256 4b360858b1e91c7fc3a7e7a715afc0869f8ca68ccdf8de8f617254c761eb5d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aon_tmp.out
        • Path C:\Users\Admin\AppData\Local\Temp\aon_tmp.out
        • Size 2KB
        • SHA256 fb590384bb1102aaa159e668c7845867d21bda8a0a0d1f555ea24ad45f7c151b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aon_tmp.out
        • Path C:\Users\Admin\AppData\Local\Temp\aon_tmp.out
        • Size 2KB
        • SHA256 3b7609e8cd32c7fb235f217826c309549a21d0098213d4e8b8f3217ac2d5708a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        islinstaller.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-0B61O.tmp\islinstaller.dll
        • Size 93KB
        • SHA256 ffac5a046a024387b96717aebd857a139c6392f1913eba1c5e0ead55d650df5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win_registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-0B61O.tmp\win_registry.dll
        • Size 92KB
        • SHA256 bb0da5b47d6bfb1569e40ade71a8cc0df8ae1182ca2d6a0ec420fc3ad2350285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_setup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-51VN5.tmp\ISLAlwaysOn_setup.tmp
        • Size 2.9MB
        • SHA256 06011a1d8e03bd7980ee643bee94831e79aa9c1c768373fa04e1b95be4601bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3584-233-0x0000000000400000-0x00000000006EE000-memory.dmp
        Download

        memory/3584-242-0x0000000000400000-0x00000000006EE000-memory.dmp
        Download

        memory/4164-102-0x0000000000400000-0x00000000004CC000-memory.dmp
        Download

        memory/4164-232-0x0000000000400000-0x00000000004CC000-memory.dmp
        Download

        memory/4164-245-0x0000000000400000-0x00000000004CC000-memory.dmp
        Download