Overview

overview

7

Static

static

7

ISL AlwaysOn.exe

windows10-2004-x64

5

ISL AlwaysOn.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 05:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ISL AlwaysOn.exe
  • Size 678KB
  • Sample260727-fwthyahc73
  • SHA256 1adc9aa12692d52d81361814c230e81979b7024d5528807429519aa2a6e4b95f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoveryinstaller

Malware Config

Signatures

  • Drops file in System32 directory 15 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 62 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ISL AlwaysOn.exe
    "C:\Users\Admin\AppData\Local\Temp\ISL AlwaysOn.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1785129234_4384_5912_682425562\ISLAlwaysOn_5_0_2551_117.exe
      ISLAlwaysOn_5_0_2551_117.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOnCheck.exe
        "C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOnCheck.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1540
        • C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe
          "C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\Users\Admin\AppData\Local\Temp\is-SF2I5.tmp\ISLAlwaysOn_setup.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-SF2I5.tmp\ISLAlwaysOn_setup.tmp" /SL5="$70210,9677807,780800,C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
            5⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2104
            • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
              "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe" service_install
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:468
            • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
              "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe" save_send_prefix /SL5="$70210,9677807,780800,C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5604
            • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
              "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe" /setup /SL5="$70210,9677807,780800,C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe" "password_md5" "811b853b50b5b277c2e031e07f346dae" "grant" "zeJwtj7tKA0EUQLkExMJGRVBB2M4YMMzcmTuPzjYosbANyDzj4rIL2YQQK8kfpNCvSqk/YKWNjbVgFPsD5xwHsPQHR7sPr88v64/30+XTce/zu7syJ2+DxWJ7/+tyVcA45A4Mbq6K67oq61QM03TeTO73YFzGDkjJQgictCXBTUjo0AVuuKecpE2aEjHyXGWvGaoUKbMoVGLRuWw9mRRd8sGZhByZCtq5KKMRlitlkDRRUJy4SJ6hFTxmq6zbcDIKnQUa8QgtgKvmbtE29XmvX7ZV89fZr9P0EGYAt8M0m7iqbIvuaBRrZFwzjppLQiTJyNCorHNzUf9j/XB3JmH2O8fsxoCCE0PcgS34AT7cWjI=" "grant_password_md5" "811b853b50b5b277c2e031e07f346dae"
              6⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              PID:4980
  • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnService.exe
    "C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnService.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3384
    • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
      "ISLAlwaysOn.exe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnTray.exe
        i tray
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DefaultConfiguration.ini
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\DefaultConfiguration.ini
        • Size 92B
        • SHA256 25c3e9036b7ac1ada5dc19dcf8b8064fae6df61b3eea323f839ce7c17a2bcdd8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ISLAlwaysOn.exe
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOn.exe
        • Size 13.6MB
        • SHA256 c65c9bc5a3afbd6e3df4bf8e8801af386c6cc31ccea60148794bb108e7e01ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOnService.exe
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnService.exe
        • Size 174KB
        • SHA256 6ae9ba20a701af82bb71df4c3ba76377b91df68df3a7f1589e45f2ed245c5ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOnTray.exe
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\ISLAlwaysOnTray.exe
        • Size 1.2MB
        • SHA256 41a8b60d4d582073d2bb64f9aa0bc598e060a90cf4894001df88751c9ff8f55d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StaticConfiguration.ini
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\StaticConfiguration.ini
        • Size 287B
        • SHA256 e359b65b3f8831be609e4f2f8ddc78ed4ad99dd1b03d866ee9152759a1eb72ab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aon_gui.out
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\aon_gui.out
        • Size 7KB
        • SHA256 bcddf906f2421099d2a57d5d565586572a8f9de6b427bc962178d2057ce7a3b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aon_service.out
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\aon_service.out
        • Size 14KB
        • SHA256 a2e56975a2aefc9fbb46f97ac39654d3979f437eaed12d3b07102571f0abb5fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        startup_info.txt
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\startup_info.txt
        • Size 76B
        • SHA256 ed4303ac4e8ad6be62c3f37eea84ce714614827c651d4c3c482142d2bcc3dc02
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tray
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\status\tray
        • Size 22B
        • SHA256 ec826a49eff80c9393a8c8a4c05fbd7f2f808d10f8a7d21dde86c5fc48d7a9d1
        • MD5 SHA1 SHA512
        Submit Download

        translations
        • Path C:\Program Files (x86)\ISL Online\ISL AlwaysOn\translations\translations
        • Size 721KB
        • SHA256 aa323a18945f8db860052e6872d9c27fb63d0014ab5bab8ef5bfc0ddda14201d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOnCheck.exe
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOnCheck.exe
        • Size 17KB
        • SHA256 e0b828f2aed90b21fcf9f5fcc965a62ade229b3fcb8a42c4a8e0f62e3bc06b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_setup.exe
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL AlwaysOn Setup\1\ISLAlwaysOn_setup.exe
        • Size 10.2MB
        • SHA256 bcac6f8ef488beaf38a2c2108771ea5393106921528e7a561f46d4b076ead328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLNetworkStart.dll
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\ISLNetworkStart.dll
        • Size 1.5MB
        • SHA256 242d1b8f110af36148211de21cbb93a825b42e27c1b1eaeee05bcd40e037209c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_5_0_2551_117.exe
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1785129234_4384_5912_682425562\ISLAlwaysOn_5_0_2551_117.exe
        • Size 10.5MB
        • SHA256 ae557eebb0f84b419559388c5b4af55d6f54559eee8cf63b7016b8c4518bc406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_5_0_2551_117.exe.extra
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\extract_1785129234_4384_5912_682425562\ISLAlwaysOn_5_0_2551_117.exe.extra
        • Size 637B
        • SHA256 e9cb9a7eddb3d7fa610cba0fcec9f4e7669e3c35b5fa0139428fc5492271d592
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        isl_network_start.log
        • Path C:\Users\Admin\AppData\Local\ISL Online Cache\ISL Network Start\1\isl_network_start.log
        • Size 5KB
        • SHA256 6b47568ddc60720f09eb5ea2d5b7a71aa09935b72b11db48d80d97f71a7663dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aon_tmp.out
        • Path C:\Users\Admin\AppData\Local\Temp\aon_tmp.out
        • Size 1KB
        • SHA256 2c2b7ea0bbba8040e3aeeb58a5e9dbed46497a51110dac1172629ec8506606d6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        aon_tmp.out
        • Path C:\Users\Admin\AppData\Local\Temp\aon_tmp.out
        • Size 2KB
        • SHA256 1d2fd8426d9c12aa9accc8ad5976593b61d4c413a1e479872d09744bfcea1352
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        islinstaller.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-F37U8.tmp\islinstaller.dll
        • Size 93KB
        • SHA256 ffac5a046a024387b96717aebd857a139c6392f1913eba1c5e0ead55d650df5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win_registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-F37U8.tmp\win_registry.dll
        • Size 92KB
        • SHA256 bb0da5b47d6bfb1569e40ade71a8cc0df8ae1182ca2d6a0ec420fc3ad2350285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISLAlwaysOn_setup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-SF2I5.tmp\ISLAlwaysOn_setup.tmp
        • Size 2.9MB
        • SHA256 06011a1d8e03bd7980ee643bee94831e79aa9c1c768373fa04e1b95be4601bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2104-231-0x0000000000400000-0x00000000006EE000-memory.dmp
        Download

        memory/2104-237-0x0000000000400000-0x00000000006EE000-memory.dmp
        Download

        memory/4272-102-0x0000000000400000-0x00000000004CC000-memory.dmp
        Download

        memory/4272-230-0x0000000000400000-0x00000000004CC000-memory.dmp
        Download

        memory/4272-241-0x0000000000400000-0x00000000004CC000-memory.dmp
        Download