Analysis
- max time kernel
149s - max time network
207s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 17:04
General
- Target The_House_in_Fata_Morgana_1.3it_(41335)_win_gog/setup_the_house_in_fata_morgana_v1.3it_(41335).exe
- Size 760KB
- Sample260810-vlmd7stdlh
- SHA256 5cd7e20c5492286f3ba19c76e4943602f8cb3e2ad47b0bc8b6807f178aba9706
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 33 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\The_House_in_Fata_Morgana_1.3it_(41335)_win_gog\setup_the_house_in_fata_morgana_v1.3it_(41335).exe"C:\Users\Admin\AppData\Local\Temp\The_House_in_Fata_Morgana_1.3it_(41335)_win_gog\setup_the_house_in_fata_morgana_v1.3it_(41335).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MJ0M0.tmp\setup_the_house_in_fata_morgana_v1.3it_(41335).tmp"C:\Users\Admin\AppData\Local\Temp\is-MJ0M0.tmp\setup_the_house_in_fata_morgana_v1.3it_(41335).tmp" /SL5="$502AA,192512,0,C:\Users\Admin\AppData\Local\Temp\The_House_in_Fata_Morgana_1.3it_(41335)_win_gog\setup_the_house_in_fata_morgana_v1.3it_(41335).exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1207665293_english.jpg
1769415595_english.jpg
1775067436_english.jpg
BigOK.png
EULAAccepted.png
EULAShow.png
background.jpg
botva2.dll
btn_md5.png
crcdll.dll
error.png
innocallback.dll
ok.png
slideshow.ini
uninstall.dll
setup_the_house_in_fata_morgana_v1.3it_(41335).tmp
eula.txt
memory/1044-145-0x00000000005C0000-0x00000000005F9000-memory.dmp
memory/1044-0-0x00000000005C0000-0x00000000005F9000-memory.dmp
memory/3252-150-0x0000000005BA0000-0x0000000005C57000-memory.dmp
memory/3252-176-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-146-0x00000000010A0000-0x00000000010A1000-memory.dmp
memory/3252-147-0x0000000003420000-0x0000000003421000-memory.dmp
memory/3252-148-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-14-0x0000000005BA0000-0x0000000005C57000-memory.dmp
memory/3252-151-0x0000000003490000-0x000000000349E000-memory.dmp
memory/3252-149-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-153-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-160-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-162-0x0000000003490000-0x000000000349E000-memory.dmp
memory/3252-159-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-165-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-170-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-171-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-59-0x0000000003490000-0x000000000349E000-memory.dmp
memory/3252-182-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-183-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-188-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-193-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-194-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-199-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-5-0x00000000010A0000-0x00000000010A1000-memory.dmp
memory/3252-205-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-204-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-210-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-211-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-216-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3252-215-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-221-0x00000000004F0000-0x0000000000642000-memory.dmp
memory/3252-222-0x0000000000400000-0x0000000000415000-memory.dmp