Resubmissions
09/08/2026, 22:46
260809-2p542swhmb709/08/2026, 22:43
260809-2nhx5aep2x709/08/2026, 22:39
260809-2kxbcaen8w7Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 22:43
General
- Target Output Portal v1.2.1 Incl Keygen-R2R/Setup Portal v1.2.1.exe
- Size 139.1MB
- Sample260809-2nhx5aep2x
- SHA256 00ee7e1b2a1a11e0c9b8b750484b9a60ffb41baea16a34339f2e71ff6b25ef2c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Output Portal v1.2.1 Incl Keygen-R2R\Setup Portal v1.2.1.exe"C:\Users\Admin\AppData\Local\Temp\Output Portal v1.2.1 Incl Keygen-R2R\Setup Portal v1.2.1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A4GR3.tmp\Setup Portal v1.2.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-A4GR3.tmp\Setup Portal v1.2.1.tmp" /SL5="$501AA,145481172,121344,C:\Users\Admin\AppData\Local\Temp\Output Portal v1.2.1 Incl Keygen-R2R\Setup Portal v1.2.1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Setup Portal v1.2.1.tmp
ISSKINU.DLL
R2RINNO.dll
SKIN.CJSTYLES
memory/1244-0-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5252-6-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5252-14-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-36-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-33-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-34-0x0000000077070000-0x0000000077095000-memory.dmp
memory/5252-32-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-30-0x0000000077070000-0x0000000077095000-memory.dmp
memory/5252-29-0x0000000075760000-0x00000000757DE000-memory.dmp
memory/5252-27-0x0000000077070000-0x0000000077095000-memory.dmp
memory/5252-25-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-23-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-22-0x0000000075760000-0x00000000757DE000-memory.dmp
memory/5252-21-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-20-0x0000000075760000-0x00000000757DE000-memory.dmp
memory/5252-43-0x0000000076080000-0x0000000076162000-memory.dmp
memory/5252-44-0x0000000076E80000-0x0000000076FD5000-memory.dmp
memory/5252-74-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-83-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-75-0x0000000073CA0000-0x0000000073DC8000-memory.dmp
memory/5252-91-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-60-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-51-0x00000000750E0000-0x00000000756BC000-memory.dmp
memory/5252-49-0x0000000073CA0000-0x0000000073DC8000-memory.dmp
memory/5252-125-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-123-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-45-0x00000000750E0000-0x00000000756BC000-memory.dmp
memory/5252-121-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-117-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-115-0x0000000073EA0000-0x0000000073ED3000-memory.dmp
memory/5252-114-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-112-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-108-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-106-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-101-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-99-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-94-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-93-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-79-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-69-0x0000000076080000-0x0000000076162000-memory.dmp
memory/5252-68-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-66-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-64-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-58-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-56-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-54-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-52-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-50-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-47-0x0000000074D00000-0x0000000074F27000-memory.dmp
memory/5252-48-0x0000000074C70000-0x0000000074CF1000-memory.dmp
memory/5252-96-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-87-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-62-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-46-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-41-0x0000000073CA0000-0x0000000073DC8000-memory.dmp
memory/5252-40-0x0000000074D00000-0x0000000074F27000-memory.dmp
memory/5252-38-0x00000000750E0000-0x00000000756BC000-memory.dmp
memory/5252-42-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-37-0x0000000076E80000-0x0000000076FD5000-memory.dmp
memory/5252-39-0x0000000076360000-0x0000000076411000-memory.dmp
memory/5252-35-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-31-0x0000000073EA0000-0x0000000073ED3000-memory.dmp
memory/5252-26-0x0000000075760000-0x00000000757DE000-memory.dmp
memory/5252-24-0x0000000075760000-0x00000000757DE000-memory.dmp
memory/5252-28-0x0000000010000000-0x0000000010061000-memory.dmp
memory/5252-154-0x0000000002440000-0x0000000002441000-memory.dmp