Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 01:14
General
- Target logioptionsplus_installer.exe
- Size 43.2MB
- Sample260729-bl3xeadc98
- SHA256 ddb00ffa1b0294d5a352dc7fd6dd764b944cb504516119bbbccc0d51950b5935
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\logioptionsplus_installer.exe"C:\Users\Admin\AppData\Local\Temp\logioptionsplus_installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\527a-5a12-d021-8e4b-c8d7\logioptionsplus_setup.exe--install-event=2cc15feb-e6b9-4832-8f29-f492d45cdd7a.optionsplus_install_finish_event2⤵
- Enumerates connected drives
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Logishrd\{3a16ed05-69c0-4d48-a554-32e4a70e5a7d}_logioptionsplus_setup\vc_redist.x64.exe"C:\ProgramData\Logishrd\{3a16ed05-69c0-4d48-a554-32e4a70e5a7d}_logioptionsplus_setup\vc_redist.x64.exe" /install /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{B2073647-2627-41AB-B2D8-02FD9C1637E6}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{B2073647-2627-41AB-B2D8-02FD9C1637E6}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Logishrd\{3a16ed05-69c0-4d48-a554-32e4a70e5a7d}_logioptionsplus_setup\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PageLegacyOptions.gif
logi_installer_shared_optionsplus.dll
vc_redist.x64.exe
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
logioptionsplus_setup.exe
vc_redist.x64.exe
logo.png
wixstdba.dll
memory/4028-62-0x000000001F250000-0x000000001F36F000-memory.dmp
memory/4028-61-0x0000000005DB0000-0x0000000005E4A000-memory.dmp
memory/4028-7-0x0000000004570000-0x0000000004578000-memory.dmp
memory/4028-87-0x0000000025830000-0x0000000025838000-memory.dmp
memory/4028-88-0x000000002ECE0000-0x000000002ED18000-memory.dmp
memory/4028-89-0x000000002ECB0000-0x000000002ECBE000-memory.dmp
memory/4028-90-0x000000001F3D0000-0x000000001F3E0000-memory.dmp
memory/4028-6-0x000000001F3D0000-0x000000001F3E0000-memory.dmp
memory/4028-5-0x0000000000D20000-0x0000000003780000-memory.dmp
memory/4028-120-0x000000001F250000-0x000000001F36F000-memory.dmp