Analysis
- user interaction
yes - max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
06/08/2026, 02:44
General
- Target G3M_setup_3.3.0.exe
- Size 116.1MB
- Sample260806-c794aafd82
- SHA256 fc27579fbf70961b29c31f4198ba0e1592e02631b0088061fec10424c4a45349
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 55 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 14 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\G3M_setup_3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\G3M_setup_3.3.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-K0ALESW0FK.tmp\G3M_setup_3.3.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-K0ALESW0FK.tmp\G3M_setup_3.3.0.tmp" /SL5="$400A4,120414270,882688,C:\Users\Admin\AppData\Local\Temp\G3M_setup_3.3.0.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\G3M\G3M.exe"C:\Program Files\G3M\G3M.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\G3M\G3M.exe"C:\Program Files\G3M\G3M.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000005041⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.json
settings.json.1156.5316.tmp
MSVCP140.dll
MSVCP140_1.dll
MSVCP140_2.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Widgets.dll
VCRUNTIME140_1.dll
QtCore.pyd
QtGui.pyd
QtNetwork.pyd
QtWidgets.pyd
sip.cp314-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_socket.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python3.dll
python314.dll
__init__.py
game_ui.py
startup.py
__init__.py
bootstrap_coordinator.py
__init__.py
__init__.py
game_modes.py
ucrtbase.dll
G3M_setup_3.3.0.tmp
memory/1156-687-0x00007FFA4A3D0000-0x00007FFA4A8A3000-memory.dmp
memory/1156-690-0x00007FFA49290000-0x00007FFA494B3000-memory.dmp
memory/1156-683-0x00007FFA49D80000-0x00007FFA4A3C9000-memory.dmp
memory/1156-662-0x00007FFA4C080000-0x00007FFA4C2E5000-memory.dmp
memory/2556-10-0x00000000012E0000-0x00000000012E1000-memory.dmp
memory/2556-9-0x0000000000440000-0x0000000000880000-memory.dmp
memory/2556-15-0x0000000000440000-0x0000000000880000-memory.dmp
memory/2556-26-0x0000000000440000-0x0000000000880000-memory.dmp
memory/2556-318-0x0000000000440000-0x0000000000880000-memory.dmp
memory/2556-6-0x00000000012E0000-0x00000000012E1000-memory.dmp
memory/5160-8-0x0000000000990000-0x0000000000A76000-memory.dmp
memory/5160-0-0x0000000000990000-0x0000000000A76000-memory.dmp
memory/5160-319-0x0000000000990000-0x0000000000A76000-memory.dmp