Analysis
- geolocation tags
- max time kernel
151s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 14:22
General
- Target PlexusX-Setup-0.9.2.exe
- Size 47.6MB
- Sample260730-rphzeabn2s
- SHA256 ea73795338f3c2125d6f43a374514c618b544470d55c5acd3a03028cd0611c87
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 23 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PlexusX-Setup-0.9.2.exe"C:\Users\Admin\AppData\Local\Temp\PlexusX-Setup-0.9.2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9V3FZVCOHI.tmp\PlexusX-Setup-0.9.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-9V3FZVCOHI.tmp\PlexusX-Setup-0.9.2.tmp" /SL5="$200254,48705612,863744,C:\Users\Admin\AppData\Local\Temp\PlexusX-Setup-0.9.2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM PlexusX.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Programs\PlexusX\PlexusX.exe"C:\Users\Admin\AppData\Local\Programs\PlexusX\PlexusX.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.Win32.SystemEvents.dll
PlexusX.dll
System.Collections.NonGeneric.dll
System.Collections.Specialized.dll
System.Collections.dll
System.ComponentModel.EventBasedAsync.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Diagnostics.Process.dll
System.Diagnostics.TraceSource.dll
System.Drawing.Common.dll
System.Drawing.Primitives.dll
System.Linq.dll
System.Memory.dll
System.Private.CoreLib.dll
System.Runtime.InteropServices.dll
System.Text.Json.dll
System.Text.RegularExpressions.dll
System.Threading.dll
System.Windows.Forms.Primitives.dll
System.Windows.Forms.dll
PlexusX-Setup-0.9.2.tmp
memory/2196-545-0x000002E080D30000-0x000002E080FCE000-memory.dmp
memory/3348-8-0x00000000002E0000-0x00000000003C1000-memory.dmp
memory/3348-498-0x00000000002E0000-0x00000000003C1000-memory.dmp
memory/3348-1-0x00000000002E0000-0x00000000003C1000-memory.dmp
memory/3516-493-0x0000000000E90000-0x00000000012CD000-memory.dmp
memory/3516-9-0x0000000000E90000-0x00000000012CD000-memory.dmp
memory/3516-10-0x0000000003570000-0x0000000003571000-memory.dmp
memory/3516-6-0x0000000003570000-0x0000000003571000-memory.dmp
memory/3516-15-0x0000000000E90000-0x00000000012CD000-memory.dmp
memory/3516-494-0x0000000000E90000-0x00000000012CD000-memory.dmp