Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 22:16
General
- Target Install.exe
- Size 10.7MB
- Sample260804-16xcss1glb
- SHA256 a095636d7f773b2e5e4cfd6ed1c9385c5d310a8996ac24b8142773b5971a6f03
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NE8PL.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-NE8PL.tmp\Install.tmp" /SL5="$400B2,9800012,313856,C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KTEHO.tmp\D3DX9_44.dll"C:\Users\Admin\AppData\Local\Temp\is-KTEHO.tmp\D3DX9_44.dll"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BASS.dll
D3DX9_44.dll
VCLStylesInno.dll
d3dx9_43.dll
Install.tmp
memory/4224-0-0x0000000000400000-0x0000000000457000-memory.dmp
memory/4224-2-0x000000000041E000-0x000000000041F000-memory.dmp
memory/4224-101-0x0000000000400000-0x0000000000457000-memory.dmp
memory/5096-76-0x0000000008910000-0x0000000008911000-memory.dmp
memory/5096-63-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-22-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-27-0x0000000008430000-0x000000000874B000-memory.dmp
memory/5096-30-0x00000000041E0000-0x00000000041E1000-memory.dmp
memory/5096-31-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-39-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-75-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-84-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-90-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-89-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-87-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-86-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-83-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-91-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-81-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-80-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-78-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-77-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-88-0x0000000008950000-0x0000000008951000-memory.dmp
memory/5096-74-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-72-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-71-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-69-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-68-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-66-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-65-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-62-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-53-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-85-0x0000000008940000-0x0000000008941000-memory.dmp
memory/5096-60-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-59-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-57-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-56-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-13-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-70-0x00000000088F0000-0x00000000088F1000-memory.dmp
memory/5096-61-0x00000000088C0000-0x00000000088C1000-memory.dmp
memory/5096-58-0x00000000088B0000-0x00000000088B1000-memory.dmp
memory/5096-19-0x00000000742F0000-0x000000007433D000-memory.dmp
memory/5096-54-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-46-0x0000000008870000-0x0000000008871000-memory.dmp
memory/5096-50-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-55-0x00000000088A0000-0x00000000088A1000-memory.dmp
memory/5096-48-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-47-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-45-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-44-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-42-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-41-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-82-0x0000000008930000-0x0000000008931000-memory.dmp
memory/5096-79-0x0000000008920000-0x0000000008921000-memory.dmp
memory/5096-73-0x0000000008900000-0x0000000008901000-memory.dmp
memory/5096-67-0x00000000088E0000-0x00000000088E1000-memory.dmp
memory/5096-64-0x00000000088D0000-0x00000000088D1000-memory.dmp
memory/5096-52-0x0000000008890000-0x0000000008891000-memory.dmp
memory/5096-49-0x0000000008880000-0x0000000008881000-memory.dmp
memory/5096-43-0x0000000008860000-0x0000000008861000-memory.dmp
memory/5096-40-0x0000000008850000-0x0000000008851000-memory.dmp
memory/5096-36-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-34-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-32-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-37-0x0000000004200000-0x0000000004201000-memory.dmp
memory/5096-38-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-51-0x0000000004080000-0x00000000041C0000-memory.dmp
memory/5096-35-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-33-0x00000000041F0000-0x00000000041F1000-memory.dmp
memory/5096-92-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-93-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-94-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-95-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-96-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-97-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-98-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-8-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-99-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-100-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-116-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-117-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/5096-118-0x0000000000400000-0x00000000008F7000-memory.dmp