Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 18:17
General
- Target file_73ed34a7752ecb3a.exe
- Size 11.2MB
- Sample260806-wxbbraxenc
- SHA256 ef56d1386af7c97a5cd0b70c261de7e87f6c00894e3f30856adfc750a7b73b3b
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file_73ed34a7752ecb3a.exe"C:\Users\Admin\AppData\Local\Temp\file_73ed34a7752ecb3a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RLTCD.tmp\file_73ed34a7752ecb3a.tmp"C:\Users\Admin\AppData\Local\Temp\is-RLTCD.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$400A0,11357099,121344,C:\Users\Admin\AppData\Local\Temp\file_73ed34a7752ecb3a.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-J4MRJ.tmp\Da_L.exe"C:\Users\Admin\AppData\Local\Temp\is-J4MRJ.tmp\Da_L.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\JAVAkubernetes_v4\Da_L.exeC:\ProgramData\JAVAkubernetes_v4\Da_L.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ASLFoundation.dll
ASLMessaging.dll
Da_L.exe
ImageRenderer.dll
MediaFoundation.dll
Memory.dll
PRM.dll
VideoFrame.dll
adobe_caps.dll
boost_date_time.dll
boost_filesystem.dll
boost_system.dll
boost_threads.dll
dvaaccelerate.dll
dvacore.dll
dvamarshal.dll
dvamediatypes.dll
dvascripting.dll
dvatransport.dll
dvaunittesting.dll
dynamiclink.dll
libmmd.dll
mc_enc_dv.dll
msvcp140.dll
vcruntime140.dll
file_73ed34a7752ecb3a.tmp
memory/1116-141-0x0000000000400000-0x000000000052E000-memory.dmp
memory/1116-6-0x0000000002420000-0x0000000002421000-memory.dmp
memory/2056-82-0x0000000000DD0000-0x00000000010B4000-memory.dmp
memory/2056-90-0x0000000001160000-0x0000000001455000-memory.dmp
memory/2056-130-0x0000000001F00000-0x0000000001F13000-memory.dmp
memory/2056-103-0x0000000001760000-0x0000000001DBA000-memory.dmp
memory/2056-97-0x0000000001520000-0x00000000016F9000-memory.dmp
memory/2056-128-0x0000000001ED0000-0x0000000001EEB000-memory.dmp
memory/2056-132-0x0000000001F30000-0x0000000001F56000-memory.dmp
memory/2056-108-0x0000000001DD0000-0x0000000001E87000-memory.dmp
memory/2056-134-0x0000000001F70000-0x0000000001F93000-memory.dmp
memory/2056-100-0x0000000001710000-0x000000000174B000-memory.dmp
memory/2056-136-0x0000000001FB0000-0x0000000002067000-memory.dmp
memory/2056-94-0x0000000001490000-0x000000000150D000-memory.dmp
memory/2056-138-0x0000000002080000-0x000000000208E000-memory.dmp
memory/2056-87-0x00000000010D0000-0x0000000001145000-memory.dmp
memory/2056-111-0x0000000000BE0000-0x0000000000CBB000-memory.dmp
memory/2056-79-0x0000000000D80000-0x0000000000DB7000-memory.dmp
memory/2056-76-0x0000000000CD0000-0x0000000000D68000-memory.dmp
memory/2056-139-0x0000000072E70000-0x0000000072F65000-memory.dmp
memory/2056-140-0x00007FF9C1D20000-0x00007FF9C1F83000-memory.dmp
memory/4436-168-0x0000000001ED0000-0x0000000001EE3000-memory.dmp
memory/4436-158-0x00000000012B0000-0x0000000001489000-memory.dmp
memory/4436-151-0x0000000000EB0000-0x0000000001194000-memory.dmp
memory/4436-182-0x0000000073D50000-0x0000000073E45000-memory.dmp
memory/4436-162-0x0000000001530000-0x0000000001825000-memory.dmp
memory/4436-160-0x00000000014A0000-0x0000000001515000-memory.dmp
memory/4436-177-0x0000000002060000-0x0000000002083000-memory.dmp
memory/4436-174-0x0000000001F70000-0x0000000001F7E000-memory.dmp
memory/4436-176-0x0000000001F90000-0x0000000002047000-memory.dmp
memory/4436-170-0x0000000001F00000-0x0000000001F1B000-memory.dmp
memory/4436-164-0x0000000001840000-0x0000000001E9A000-memory.dmp
memory/4436-156-0x0000000001260000-0x000000000129B000-memory.dmp
memory/4436-180-0x00007FF9C1D20000-0x00007FF9C1F83000-memory.dmp
memory/4436-154-0x00000000011D0000-0x000000000124D000-memory.dmp
memory/4436-149-0x0000000000DE0000-0x0000000000E97000-memory.dmp
memory/4436-147-0x0000000000CF0000-0x0000000000DCB000-memory.dmp
memory/4436-144-0x0000000000CA0000-0x0000000000CD7000-memory.dmp
memory/4436-142-0x0000000000BF0000-0x0000000000C88000-memory.dmp
memory/4436-179-0x0000000073D50000-0x0000000073E45000-memory.dmp
memory/4896-0-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4896-167-0x0000000000400000-0x0000000000428000-memory.dmp