Overview

overview

8

Static

static

5

Lightburn....st.cmd

windows10-2004-x64

8

Lightburn....st.cmd

windows11-ltsc_2024-x64

8

Lightburn....rn.exe

windows10-2004-x64

1

Lightburn....rn.exe

windows11-ltsc_2024-x64

1

Lightburn....03.exe

windows10-2004-x64

7

Lightburn....03.exe

windows11-ltsc_2024-x64

7

Lightburn....iR.url

windows10-2004-x64

4

Lightburn....iR.url

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    151s
  • max time network
    164s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 21:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Lightburn.2.1.03.x64/LightBurn-v2.1.03.exe
  • Size 166.0MB
  • Sample260811-z2mgcssarg
  • SHA256 178fb4d4632b6e1aa977f2e90101153bcfe4ac5e15a69604f8de8ff9314d1063
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 24 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lightburn.2.1.03.x64\LightBurn-v2.1.03.exe
    "C:\Users\Admin\AppData\Local\Temp\Lightburn.2.1.03.x64\LightBurn-v2.1.03.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Local\Temp\is-CB3D4.tmp\LightBurn-v2.1.03.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CB3D4.tmp\LightBurn-v2.1.03.tmp" /SL5="$400A0,173241481,735744,C:\Users\Admin\AppData\Local\Temp\Lightburn.2.1.03.x64\LightBurn-v2.1.03.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp\vcredist_2015-2022_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp/vcredist_2015-2022_x64.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5420
        • C:\Windows\Temp\{6A1D7DC3-8A8C-4404-8963-0E4371F1E3CA}\.cr\vcredist_2015-2022_x64.exe
          "C:\Windows\Temp\{6A1D7DC3-8A8C-4404-8963-0E4371F1E3CA}\.cr\vcredist_2015-2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp\vcredist_2015-2022_x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5912
      • C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp\DoCheckLightBurn.exe
        "C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp/DoCheckLightBurn.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        PID:252
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\LightBurn\LBShellExtThumbnailHandler.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:3388
      • C:\Program Files\LightBurn\LightBurn.exe
        "C:\Program Files\LightBurn\LightBurn.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LBShellExtThumbnailHandler.dll
        • Path C:\Program Files\LightBurn\LBShellExtThumbnailHandler.dll
        • Size 126KB
        • SHA256 390f8ed9a111041426bc1d2586478207d928dff0c2fbca47f37223f7a9b5511b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LightBurn.exe
        • Path C:\Program Files\LightBurn\LightBurn.exe
        • Size 25.7MB
        • SHA256 08646bb21de1e3f3edd70a272b78cff74a33f17fe3c9b473b36a49523ccbfb8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Program Files\LightBurn\Qt6Gui.dll
        • Size 7.7MB
        • SHA256 c1b277c000105c632ec62beec4fe1aeeed738b45a128b049cc494fb86ba19b39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Multimedia.dll
        • Path C:\Program Files\LightBurn\Qt6Multimedia.dll
        • Size 777KB
        • SHA256 0dc40362ebb67e93e75971cdc0f36819d68189089403223c3d48efef5e0b6724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Network.dll
        • Path C:\Program Files\LightBurn\Qt6Network.dll
        • Size 1.3MB
        • SHA256 a390ce28e5acebd558544de1392ff5470d7f0b6bfc99c6ef5ab6f38d7decf9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6OpenGL.dll
        • Path C:\Program Files\LightBurn\Qt6OpenGL.dll
        • Size 1.8MB
        • SHA256 33bf8c353833d0bda6e4508eac499c1af75013d9a98059e66578762fe18b4e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Positioning.dll
        • Path C:\Program Files\LightBurn\Qt6Positioning.dll
        • Size 469KB
        • SHA256 5f35790f293c318cab5dc962a26b1e90374eac85cb78b2d67b8c70439d1aa509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6PrintSupport.dll
        • Path C:\Program Files\LightBurn\Qt6PrintSupport.dll
        • Size 385KB
        • SHA256 67be81ea0efbebf2fb44de246a211a25df3da2ed7a788715990d66349508835d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Qml.dll
        • Path C:\Program Files\LightBurn\Qt6Qml.dll
        • Size 4.4MB
        • SHA256 cadc85a0dd0561de44fe8e1918a5b3f32a4e14f92618610b0089daa60fa53d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6QmlModels.dll
        • Path C:\Program Files\LightBurn\Qt6QmlModels.dll
        • Size 673KB
        • SHA256 37f46eb9e08b739516a275c7ee06bc63701b07a159f9d727ca2feb5702ce22b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Quick.dll
        • Path C:\Program Files\LightBurn\Qt6Quick.dll
        • Size 5.0MB
        • SHA256 76763b11c61dea487e36985aefa522d883e3bea26ded1c8a284ed6aeee07d68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6QuickWidgets.dll
        • Path C:\Program Files\LightBurn\Qt6QuickWidgets.dll
        • Size 115KB
        • SHA256 c7de1fdd94558eecd585141abfb590025468565a3af47ac63520117467b6aa0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6SerialPort.dll
        • Path C:\Program Files\LightBurn\Qt6SerialPort.dll
        • Size 116KB
        • SHA256 282b8910058a14dec41ffd0368efa375db7da373ca6c5410de257f291e4fde23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6WebChannel.dll
        • Path C:\Program Files\LightBurn\Qt6WebChannel.dll
        • Size 241KB
        • SHA256 9d5cd3daa376c1188b910d18c3a1d65165dcfedf5b6ed9a729a165259cd1043e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6WebEngineWidgets.dll
        • Path C:\Program Files\LightBurn\Qt6WebEngineWidgets.dll
        • Size 174KB
        • SHA256 09a276c485cd66f864aa0ec4c621e5486bb22c5cd6b1b47499c0902d87da0d98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Program Files\LightBurn\Qt6Widgets.dll
        • Size 5.8MB
        • SHA256 31e27d61bb7c213b256b6d3aa2a1d7536310aa1957cb1f8459bbaabda7339cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Xml.dll
        • Path C:\Program Files\LightBurn\Qt6Xml.dll
        • Size 144KB
        • SHA256 5720078fc541eed0193aef2e6b1bdd2023d5adcf511457a60711af547a9d0d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libusb-1.0.dll
        • Path C:\Program Files\LightBurn\libusb-1.0.dll
        • Size 157KB
        • SHA256 1dac95d1eafcba057cf3df73dcf419bc14f4167ef4ac92fe1f8fdcab4278b6f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        potrace.dll
        • Path C:\Program Files\LightBurn\potrace.dll
        • Size 54KB
        • SHA256 e9033271bec05322dedf6bf51890ee5563a553addf3999fd996cf7eacf57a2b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LightBurn-v2.1.03.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-CB3D4.tmp\LightBurn-v2.1.03.tmp
        • Size 2.9MB
        • SHA256 57a896787adc639d8631f82e658af354d09a3f1ef55db3a3a0685ecec2ff4fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DoCheckLightBurn.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp\DoCheckLightBurn.exe
        • Size 1.5MB
        • SHA256 92e194ab82225fc02288141380c2bfe4d525e5e8d8f437c50cccbf2414200b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp\Qt6Core.dll
        • Size 5.3MB
        • SHA256 be9c1796ee7566cc4eb9c2a4452cada3ff534f6e11f3dace6d567a75c0a25405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcredist_2015-2022_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-TJ4QA.tmp\vcredist_2015-2022_x64.exe
        • Size 24.2MB
        • SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{48EC72A6-7F18-4E97-98DC-B4B517C1A5B7}\.ba\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{48EC72A6-7F18-4E97-98DC-B4B517C1A5B7}\.ba\wixstdba.dll
        • Size 191KB
        • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcredist_2015-2022_x64.exe
        • Path C:\Windows\Temp\{6A1D7DC3-8A8C-4404-8963-0E4371F1E3CA}\.cr\vcredist_2015-2022_x64.exe
        • Size 635KB
        • SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2176-565-0x00007FF99F840000-0x00007FF99FE05000-memory.dmp
        Download

        memory/2176-583-0x00007FF6AC770000-0x00007FF6AE1DF000-memory.dmp
        Download

        memory/2176-572-0x00007FF99E3D0000-0x00007FF99E8C9000-memory.dmp
        Download

        memory/2176-584-0x000000006EF40000-0x000000006EF56000-memory.dmp
        Download

        memory/4740-62-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/4740-1-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/4740-576-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/5052-81-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download

        memory/5052-63-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download

        memory/5052-64-0x0000000000950000-0x0000000000951000-memory.dmp
        Download

        memory/5052-74-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download

        memory/5052-574-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download

        memory/5052-575-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download

        memory/5052-6-0x0000000000950000-0x0000000000951000-memory.dmp
        Download

        memory/5052-77-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download

        memory/5052-79-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download

        memory/5052-162-0x0000000000400000-0x00000000006F5000-memory.dmp
        Download