Analysis

  • max time kernel
    299s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 23:39

General

  • Target
    ANIMO-x86_64-0.0.11+11-Installer.exe
  • Size 19.8MB
  • Sample260808-3nbpgszycx
  • SHA256 bc608ae29b34bd24fd92b2d3171df9e814086afaca4d3c64c1d64160d0c86d61
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 21 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ANIMO-x86_64-0.0.11+11-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ANIMO-x86_64-0.0.11+11-Installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Users\Admin\AppData\Local\Temp\is-7OGNKQKEWA.tmp\ANIMO-x86_64-0.0.11+11-Installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7OGNKQKEWA.tmp\ANIMO-x86_64-0.0.11+11-Installer.tmp" /SL5="$400C4,19547957,844800,C:\Users\Admin\AppData\Local\Temp\ANIMO-x86_64-0.0.11+11-Installer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Program Files\ANIMO\animo.exe
        "C:\Program Files\ANIMO\animo.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll

        • Path C:\Program Files\ANIMO\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Webview2Loader.dll

        • Path C:\Program Files\ANIMO\Webview2Loader.dll
        • Size 134KB
        • SHA256 c4674acf95f0800793a4a6d61132adf5dfa694c218e482d86093494c4e84100a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        animo.exe

        • Path C:\Program Files\ANIMO\animo.exe
        • Size 260KB
        • SHA256 f4b0cbb36b2a880720580a6223bc20894ced9f5b2b31793e22aa1aaa0448f8a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app_links_plugin.dll

        • Path C:\Program Files\ANIMO\app_links_plugin.dll
        • Size 136KB
        • SHA256 6fbf423c7746751274c1110dacfc34f25862ff70cb370599c4ea90dba9b77e79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        awesome_notifications_plugin.dll

        • Path C:\Program Files\ANIMO\awesome_notifications_plugin.dll
        • Size 87KB
        • SHA256 d6f03d11a9fc6162a4c2f738e5cbf1a477147afd52833914198833e88c5a1939
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.so

        • Path C:\Program Files\ANIMO\data\app.so
        • Size 8.8MB
        • SHA256 99e3ffdbb4d291c214c69c45241642327ad94e50196ee141a75a56ba6e50aa18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssetManifest.bin

        • Path C:\Program Files\ANIMO\data\flutter_assets\AssetManifest.bin
        • Size 3KB
        • SHA256 4c814f232c51f88709ef50deb6c517a415ced591e787f28b943b8f9ab0659102
        • MD5 SHA1 SHA512 TLSH

        FontManifest.json

        • Path C:\Program Files\ANIMO\data\flutter_assets\FontManifest.json
        • Size 1KB
        • SHA256 6fb81124846f17740bcd3b025bce2a935209a2a78e85166c3b0d46a0b318b179
        • MD5 SHA1 SHA512 TLSH

        NativeAssetsManifest.json

        • Path C:\Program Files\ANIMO\data\flutter_assets\NativeAssetsManifest.json
        • Size 45B
        • SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
        • MD5 SHA1 SHA512

        MaterialIcons-Regular.otf

        • Path C:\Program Files\ANIMO\data\flutter_assets\fonts\MaterialIcons-Regular.otf
        • Size 1.6MB
        • SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSans-Bold.ttf

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\fonts\NotoSans-Bold.ttf
        • Size 544KB
        • SHA256 8b6389d671315ddf9e50ab4419a3b8a40298b709a46e785a345ef2ecf473b8d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSans-Regular.ttf

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\fonts\NotoSans-Regular.ttf
        • Size 543KB
        • SHA256 2ec33f84606cbaa0a1a944488e14f97faf2f6a25ecdd8354f5358f06da13c7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NunitoSans_10pt-Bold.ttf

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\fonts\NunitoSans_10pt-Bold.ttf
        • Size 110KB
        • SHA256 0a138b9e128a0f5ec0937043e7ec07d873ac0d67a513e191a6b508d182753024
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NunitoSans_10pt-Medium.ttf

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\fonts\NunitoSans_10pt-Medium.ttf
        • Size 111KB
        • SHA256 4776f94e4230a3cd1581ae33d7d26428ed3ec2891a0849e386c7ee83f93607c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Rubik-Bold.ttf

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\fonts\Rubik-Bold.ttf
        • Size 203KB
        • SHA256 e1bc0a0ff1fff1d1c69d2550998717cc8c780c4a8a5b334a41e36aff5d2f98ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Rubik-Medium.ttf

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\fonts\Rubik-Medium.ttf
        • Size 203KB
        • SHA256 99699974e6a8122584cc6c74a6b7e2c431cd4c82bc47e121cb0b5b864cdfdf0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logo_foreground.png

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\icons\logo_foreground.png
        • Size 566KB
        • SHA256 bebe790ec53797ca873f1fc46be888e0aa9413bb4bfe8586ca5ea7d3c2eecf20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fluent_close.svg

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\images\fluent_close.svg
        • Size 721B
        • SHA256 f460643724a90bb903bd868817cb3a7fead4090730a5bf6af19d177e0694360f
        • MD5 SHA1 SHA512 TLSH

        fluent_max.svg

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\images\fluent_max.svg
        • Size 239B
        • SHA256 ea7bd5ab0b59a6ae8bf5fcc49918dcbeac5627eb992b9fd1ce9520b30d8a1824
        • MD5 SHA1 SHA512 TLSH

        fluent_min.svg

        • Path C:\Program Files\ANIMO\data\flutter_assets\lib\assets\images\fluent_min.svg
        • Size 264B
        • SHA256 62542705534c69ab034322f369dbdef9c6c9433d302d8ad680ec8a1d98ae656a
        • MD5 SHA1 SHA512 TLSH

        icudtl.dat

        • Path C:\Program Files\ANIMO\data\icudtl.dat
        • Size 842KB
        • SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop_webview_window_plugin.dll

        • Path C:\Program Files\ANIMO\desktop_webview_window_plugin.dll
        • Size 180KB
        • SHA256 5c0f183a4d4157300155ef254b2aec9d8e772456593dbfee90accfb5e7b4a3fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dynamic_color_plugin.dll

        • Path C:\Program Files\ANIMO\dynamic_color_plugin.dll
        • Size 81KB
        • SHA256 969c951b2f55825047323f8dce7cf8cff90b784525ac5fb741abc5f6a3118b45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flutter_secure_storage_windows_plugin.dll

        • Path C:\Program Files\ANIMO\flutter_secure_storage_windows_plugin.dll
        • Size 156KB
        • SHA256 da3d8e2bf2866012f70ed0e832952d1681e5e17432e15f4388254bce91323915
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flutter_windows.dll

        • Path C:\Program Files\ANIMO\flutter_windows.dll
        • Size 20.3MB
        • SHA256 61b77bc881f5c57af5f3eeac4a96ffd9fd87e35b77565f44c678de105c92c2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fvp.dll

        • Path C:\Program Files\ANIMO\fvp.dll
        • Size 128KB
        • SHA256 2a6aae0a6327e5746677a72e33778ec7a50257e718c4a645cdf92527711b3199
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mdk.dll

        • Path C:\Program Files\ANIMO\mdk.dll
        • Size 2.4MB
        • SHA256 506d9e8bd76b68936e345d8d4897d093ac52add3f742f6f946c3992adf3e8a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Program Files\ANIMO\msvcp140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        permission_handler_windows_plugin.dll

        • Path C:\Program Files\ANIMO\permission_handler_windows_plugin.dll
        • Size 117KB
        • SHA256 a70a67a7c62a5dd8b3072b94f9e4fa85fa65ac090e9109110b95082c69908a78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        screen_brightness_windows_plugin.dll

        • Path C:\Program Files\ANIMO\screen_brightness_windows_plugin.dll
        • Size 109KB
        • SHA256 df75478943f47834558347c7a4d9d6166b1ab59e3d9fbd787be49ce78e45b449
        • MD5 SHA1 SHA512 SSDEEP TLSH

        screen_retriever_windows_plugin.dll

        • Path C:\Program Files\ANIMO\screen_retriever_windows_plugin.dll
        • Size 116KB
        • SHA256 b96ce9d91ae5e84d10db6bce22cbe4b5a171e4307a21a9a2991d956b41058680
        • MD5 SHA1 SHA512 SSDEEP TLSH

        url_launcher_windows_plugin.dll

        • Path C:\Program Files\ANIMO\url_launcher_windows_plugin.dll
        • Size 96KB
        • SHA256 ffc7e56fed3c02ea0af6a5217935f2fd0c9c151825dc61cbbabac6a0561e9f11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_1.dll

        • Path C:\Program Files\ANIMO\vcruntime140_1.dll
        • Size 48KB
        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        window_manager_plugin.dll

        • Path C:\Program Files\ANIMO\window_manager_plugin.dll
        • Size 127KB
        • SHA256 a923c147a639fd79723b76aede3f78c173ad177b58a8c65ea0bf6972f1294287
        • MD5 SHA1 SHA512 SSDEEP TLSH

        window_to_front_plugin.dll

        • Path C:\Program Files\ANIMO\window_to_front_plugin.dll
        • Size 78KB
        • SHA256 32ec19ad1cabaa33a1f71a34bea687aab2429426d52428cdd673e99b362587cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ANIMO-x86_64-0.0.11+11-Installer.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-7OGNKQKEWA.tmp\ANIMO-x86_64-0.0.11+11-Installer.tmp
        • Size 4.1MB
        • SHA256 523cf079c50b8a365ec469165d4c6f693d3f05177dfa0f80a9e88184cf428487
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libCachedImageData.json

        • Path C:\Users\Admin\AppData\Roaming\com.example\ANIMO\libCachedImageData.json
        • Size 12KB
        • SHA256 551ea82940746dd6693a882c9780dcb060fee8436d0885bdbfd6c511248aa9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1840-220-0x000001A979F80000-0x000001A97A000000-memory.dmp

        memory/1840-213-0x000001A9768A0000-0x000001A9768A1000-memory.dmp

        memory/1840-215-0x000001A979580000-0x000001A979E49000-memory.dmp

        memory/1840-216-0x000001A979580000-0x000001A979E49000-memory.dmp

        memory/1840-217-0x000001A9768B0000-0x000001A9768B1000-memory.dmp

        memory/1840-221-0x000001A979F80000-0x000001A97A000000-memory.dmp

        memory/1840-214-0x000001A979580000-0x000001A979E49000-memory.dmp

        memory/2348-9-0x0000000000550000-0x0000000000987000-memory.dmp

        memory/2348-12-0x0000000000550000-0x0000000000987000-memory.dmp

        memory/2348-10-0x0000000001BE0000-0x0000000001BE1000-memory.dmp

        memory/2348-207-0x0000000000550000-0x0000000000987000-memory.dmp

        memory/2348-6-0x0000000001BE0000-0x0000000001BE1000-memory.dmp

        memory/3704-8-0x0000000000C30000-0x0000000000D0D000-memory.dmp

        memory/3704-1-0x0000000000C30000-0x0000000000D0D000-memory.dmp

        memory/3704-209-0x0000000000C30000-0x0000000000D0D000-memory.dmp