Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 06:33
General
- Target 2.exe
- Size 23.0MB
- Sample260730-hbbhqssdlb
- SHA256 c9261d7bbdb969d26836a98e3f7b60d7d0de41b125bdbb5196c1ce2ab7d137f5
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 17 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{60F6F0CB-03E7-4C1E-A761-9B23A948C515}\2.exeC:\Users\Admin\AppData\Local\Temp\{60F6F0CB-03E7-4C1E-A761-9B23A948C515}\2.exe -package:"C:\Users\Admin\AppData\Local\Temp\2.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{60F6F0CB-03E7-4C1E-A761-9B23A948C515}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{60F6F0CB-03E7-4C1E-A761-9B23A948C515}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{60F6F0CB-03E7-4C1E-A761-9B23A948C515}\Disk1\2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{29400C4E-6683-4BCD-A23C-76A78FBA4726}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{812A10CF-91D7-43C6-A695-DF35E30C9C1A}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F0F1CF80-A83D-4FB0-80DE-A72554E55783}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5B6B656C-3369-4BD4-9F08-027C90B41FF0}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{60929825-3A39-49B8-9941-8934A8542E63}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA9941C4-FF30-492A-AD15-50E2F8EC7B25}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\{4E2E774F-592C-4198-B7CA-0B66420A56DC}\DigitalUnit.exeC:\Users\Admin\AppData\Local\Temp\{33595888-1379-4AFB-AF73-5613E0A9AEA5}\{4E2E774F-592C-4198-B7CA-0B66420A56DC}\DigitalUnit.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ISBEW64.exe
Amnet.dll
Comn.dll
DIFxData.ini
DigitalUnit.exe
FontData.ini
NTHelp.dll
QtCore4.dll
QtGui4.dll
_isres_0x0409.dll
_isuser_0x0409.dll
isrt.dll
libcrypto-1_1.dll
libssl-1_1.dll
0x0409.ini
2.exe
ISSetup.dll
data1.cab
data1.hdr
layout.bin
setup.inx
setup.ini
memory/3472-196-0x0000000000B60000-0x0000000000B87000-memory.dmp
memory/3472-198-0x0000000000BA0000-0x0000000000BF8000-memory.dmp
memory/3472-203-0x0000000000C10000-0x0000000000CAE000-memory.dmp
memory/3472-208-0x0000000000CB0000-0x0000000000EED000-memory.dmp
memory/4348-150-0x0000000006F70000-0x0000000007137000-memory.dmp
memory/4348-144-0x0000000010000000-0x0000000010114000-memory.dmp
memory/4348-145-0x0000000006CF0000-0x0000000006CF2000-memory.dmp
memory/4348-211-0x0000000006CF0000-0x0000000006CF2000-memory.dmp