Overview

overview

7

Static

static

3

RSMB-TWIXT...CE.exe

windows10-2004-x64

7

Resubmissions

30/07/2026, 15:06

260730-sg4ftabd75

30/07/2026, 15:03

260730-sffclazgnc7

Analysis

  • user interaction
    yes
  • max time kernel
    38s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.exe
  • Size 19.1MB
  • Sample260730-sffclazgnc
  • SHA256 f694fd35cd33ed67ce71eeda8d9de317dc80ce8779b7072732ed2dedc3a2719c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.exe
    "C:\Users\Admin\AppData\Local\Temp\RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3844
    • C:\Users\Admin\AppData\Local\Temp\is-52ICV.tmp\RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-52ICV.tmp\RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.tmp" /SL5="$60248,19587053,165888,C:\Users\Admin\AppData\Local\Temp\RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2592
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        is-ICPUS.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\DEFlicker1OFX\DEFlickerTimelapse.ofx.bundle\Contents\Resources\is-ICPUS.tmp
        • Size 3KB
        • SHA256 8acaa4825752d535bfcdbad228de9dc4bdea04313e2c7cdd2fdaaf440e83fe6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-3FJFB.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\DEFlicker1OFX\DEFlickerTimelapse.ofx.bundle\Contents\is-3FJFB.tmp
        • Size 1KB
        • SHA256 b4844f790e7fb449151867fc93a5620d6c9a319a21be013be809af9c4559cd75
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-5C2RM.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\DEFlicker1OFX\DEFlickerTimelapse.ofx.bundle\is-5C2RM.tmp
        • Size 80B
        • SHA256 6be3564053acee4f5ee16e6c6dc2709d18966f216ac139880902b62e54b27865
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-F0M93.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\DEFlicker1OFX\DEFlickerTimelapse.ofx.bundle\is-F0M93.tmp
        • Size 70KB
        • SHA256 af88219fb0ed1ec297185020faad527c2da6f0382dc150dcfbfc8ef87ab0ad12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-JA1OC.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\RELens1OFX\RELensCurvedMirror.ofx.bundle\Contents\Resources\is-JA1OC.tmp
        • Size 5KB
        • SHA256 16edcac62757b0e2b122a1339c862b3f1bbd9ea45d1c0e2417b9b40348ecd573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-USJG7.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\RELens1OFX\RELensDefish.ofx.bundle\Contents\is-USJG7.tmp
        • Size 1KB
        • SHA256 759981931d14db99146bc337bca845d402759f72873fc6a13cb1d6af596cfb83
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-1SP52.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\REMap3OFX\remap_distort.ofx.bundle\Contents\is-1SP52.tmp
        • Size 1KB
        • SHA256 a409b946e6d8ba33007616d4c3bc59498189c450b0f14e2ee8409d3fd8f757ed
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-OS1N3.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\RSMB5OFX\rsmbvectors.ofx.bundle\Contents\is-OS1N3.tmp
        • Size 1KB
        • SHA256 881eb909849d0ab06590f2422cfc3b2232a88b050103d66da5fd957d0133ddee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        is-UIG5F.tmp
        • Path C:\Program Files\Common Files\OFX\Plugins\Twixtor6OFX\twixtor_pro.ofx.bundle\Contents\is-UIG5F.tmp
        • Size 1KB
        • SHA256 3aed85f702b8b3c774cb14f387980e422850f33161b2a8b58c6529bf02ed9e90
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-52ICV.tmp\RSMB-TWIXTOR-EFXN13OFX-13.0.3.CE.tmp
        • Size 1.2MB
        • SHA256 9be09e4f546088b4532be0f3246078b558ca2027cdbfc5ac405d5864aa87a9b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _iscrypt.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-QF92J.tmp\_isetup\_iscrypt.dll
        • Size 2KB
        • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2128-367-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-369-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-366-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-365-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-368-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-370-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-371-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-359-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-361-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2128-360-0x000001F43E070000-0x000001F43E071000-memory.dmp
        Download

        memory/2592-357-0x0000000000400000-0x0000000000538000-memory.dmp
        Download

        memory/2592-5-0x00000000022E0000-0x00000000022E1000-memory.dmp
        Download

        memory/2592-355-0x0000000000400000-0x0000000000538000-memory.dmp
        Download

        memory/2592-356-0x00000000022E0000-0x00000000022E1000-memory.dmp
        Download

        memory/3844-0-0x0000000000400000-0x0000000000432000-memory.dmp
        Download

        memory/3844-358-0x0000000000400000-0x0000000000432000-memory.dmp
        Download

        memory/3844-354-0x0000000000400000-0x0000000000432000-memory.dmp
        Download