34d1bb66f5ce8899c92bf6943fea6e9664e1d730886ca7f901b2d57c97134a79

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Epson_L5390_Series_EM_10_Web.exe
Size 2.4MB
Sample260804-hgfdwaysbz
SHA256 34d1bb66f5ce8899c92bf6943fea6e9664e1d730886ca7f901b2d57c97134a79
MD5 ec8d04daa06790ed618009c0d6bbac61
SHA1 d06d85eda476c9f13e61746b73fe788f56aa7b5a
SHA512 c196afcb517a894c185509f3ab4ac404563368f04435ebb42118cd63d66966a8cd8928a66fb8e37d2d021575ec6a5d1242843f1bfcbba8c54f621f46aaa71440
SSDEEP 49152:4Cz319vefLtVpKEAIc7DWJRha4Kr4vIZN+n0H4f14hl1EH6L7J7o7C/:txwfLdKEASJja49vE40H4f16bPXH/
TLSH
T1CEC59AE29E9EF1ACFD1834388A55F074DB2EA9760E91D0E43B6DA11D0BFF2605931163
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2740	Epson_L5390_Series_EM_10_Web.tmp
1824	InstallNavi.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epson_L5390_Series_EM_10_Web.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epson_L5390_Series_EM_10_Web.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallNavi.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000400000-0x000000000046E000-memory.dmp	innosetup
behavioral1/memory/2296-125-0x0000000000400000-0x000000000046E000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	Epson_L5390_Series_EM_10_Web.tmp
2740	Epson_L5390_Series_EM_10_Web.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2740	Epson_L5390_Series_EM_10_Web.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1824	InstallNavi.exe
1824	InstallNavi.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2740	2296	Epson_L5390_Series_EM_10_Web.exe	85
PID 2740 wrote to memory of 1824	2740	Epson_L5390_Series_EM_10_Web.tmp	86

C:\Users\Admin\AppData\Local\Temp\Epson_L5390_Series_EM_10_Web.exe
"C:\Users\Admin\AppData\Local\Temp\Epson_L5390_Series_EM_10_Web.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\is-MSIFC.tmp\Epson_L5390_Series_EM_10_Web.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MSIFC.tmp\Epson_L5390_Series_EM_10_Web.tmp" /SL5="$A005C,2090145,410624,C:\Users\Admin\AppData\Local\Temp\Epson_L5390_Series_EM_10_Web.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\L5390_Series_(EM)\Downloader\InstallNavi.exe
    "C:\Users\Admin\AppData\Local\Temp\L5390_Series_(EM)\Downloader\InstallNavi.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallNavi.exe

Path C:\Users\Admin\AppData\Local\Temp\L5390_Series_(EM)\Downloader\InstallNavi.exe
Size 4.0MB
SHA256 c869c0bad0284f8947e459a3d491b33771182ec9364be2da11ed2b42f9ebce76
MD5 26d42867d3d86e75a9397dca8250d548
SHA1 0a0ef908d9f760d3d14e87818fa89b0ad2618acd
SHA512 f8b44071cc65d57cbb7a9e2ccef951beeff4e92923ee29de757e669faccbff1918a49905c5610ddd152cc709ac24f4f0b8a44d227d04da5531a18ade519e9c3b
SSDEEP 98304:elte+Tc5lWtpE30/s6QmzfIk9DBG5OgFZjiKY0pOHM6KquMjsTbX1yJjbbK+uJbD:t2tpI0ZF9DBG59uFgVPAFLOyomFHKnPF
TLSH
T1C216B0213EE9407BD56309729AE8B338D1EDBD602B36014762943E69A9F1FC17729D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

string.us

Path C:\Users\Admin\AppData\Local\Temp\L5390_Series_(EM)\Downloader\_res\_style\string.us
Size 1KB
SHA256 8142fe6f97a99dee951cb75fd33c71ee090a2729a2ee16dff488ae1b277a1bf7
MD5 363a7a4132a02cc19a4c34d20e42dcc9
SHA1 c67a9fc6b88292a63741ea88a0c2d8d7c2c4d7b2
SHA512 e029071c6e3352566b4aff0035de29635a57d5e1c6e8190bdca193dc435bb15f2711c23985a1912b32d2cb08582a4f32a8a5a800cf33b8a8487177a4a1c62b2f
TLSH
T1D221034223F80148BAF37B01AAB98C30497BBCAD993AC21C558D184E07F3A509D65FB7
MD5 SHA1 SHA512 TLSH

Submit Download

Epson_L5390_Series_EM_10_Web.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MSIFC.tmp\Epson_L5390_Series_EM_10_Web.tmp
Size 1.4MB
SHA256 186f0a81c2138c1fed646cc1906aa31ca88c46e3f50a3210f23e62ef688b3608
MD5 c6f93c6aab0c34e9412b9740788fc555
SHA1 0547dbdd22d0e026c46784babc657ae5816e5c76
SHA512 2c98b1e9f02a72f3ef95994173eefaddddd051cd7bfb926c84dceb58475601a9eb1a8b40b8a3d938762f429f695c18204411a429ef05aa90b9b7d095ccc74467
SSDEEP 24576:hnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtszpqx9Dz7h57m:BHeKh4nqzF3PYdStsz8p7h57m
TLSH
T10965D6B19E9AF03EF8223A348D56F174DA2A79311F64D4C93FAC590C0BBF6606935253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2296-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2296-125-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2740-5-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/2740-124-0x0000000000400000-0x0000000000574000-memory.dmp

Download