19953d9e5b671a0e915181a22db83cfd96b774d78519ae06d3e7ae2ac209aa3b

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Intaller-1.9.5.9.exe
Size 24.9MB
Sample260812-sgcm4azckd
SHA256 19953d9e5b671a0e915181a22db83cfd96b774d78519ae06d3e7ae2ac209aa3b
MD5 cec96fc1b4de83e385815a99b4cbbfc5
SHA1 378317bb885b5b1a00a6d371bd6c69efa7b26e00
SHA512 1557e2e90e9945f64b63e7172cc3717a452c9cc6fefe85d3352352824ec6853b8679984ce3f15fd3cbd7831eef207bf824e02b9da02234580bda298056125144
SSDEEP 393216:NtpJhyjjKcLsTxclcNsDPrr6of5MJ7ZWqxPAIgtMIMlFRqTGAms7kT96ZSTlyocz:NtpafBsTmOaDPrrKJBH5lFRqTzLSTlEx
TLSH
T1174733367AA19075D77236349A98A339E67DAD30AF3842D722D03D3C6E715C24A3C61F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c51c-5.dat	upx
behavioral2/memory/1636-10-0x0000000000B70000-0x0000000001170000-memory.dmp	upx
behavioral2/memory/1636-494-0x0000000000B70000-0x0000000001170000-memory.dmp	upx
behavioral2/memory/1636-520-0x0000000000B70000-0x0000000001170000-memory.dmp	upx
behavioral2/memory/1636-549-0x0000000000B70000-0x0000000001170000-memory.dmp	upx
behavioral2/memory/1636-550-0x0000000000B70000-0x0000000001170000-memory.dmp	upx

Executes dropped EXE 1 IoCs

pid	Process
1636	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
1636	irsetup.exe
1636	irsetup.exe
1636	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Intaller-1.9.5.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1636	irsetup.exe
1636	irsetup.exe
1636	irsetup.exe
1636	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1636	1260	Intaller-1.9.5.9.exe	89

C:\Users\Admin\AppData\Local\Temp\Intaller-1.9.5.9.exe
"C:\Users\Admin\AppData\Local\Temp\Intaller-1.9.5.9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3962378 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Intaller-1.9.5.9.exe" "__IRCT:3" "__IRTSS:26139827" "__IRSID:S-1-5-21-3611646547-550105268-947503007-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

200.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Size 116KB
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
SSDEEP 1536:5HmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg:UfoZll0bGVmjWh
TLSH
T1C6C330260E6D3150D3992D79BEEAE3384E764D90EC6D21A314ED782AF9376EC13ED440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdditionalFunction.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalFunction.exe
Size 3.7MB
SHA256 807461fdab132672b96e0a8dae6c41fd3e1ddb3ad87eeb821e87aba4057f6f20
MD5 fcbc71e3ab16883d79dfc8e714cb8e57
SHA1 db0b2e1162f15df20ea54db0877b7c15c9bd9a1f
SHA512 08371ebbcacb9690a32dc9ffaef03e8a95124aaea4c8ef90060ccf2cd320ceef82161ef0eff24a2fef77249be0aba74aa1558ff36a57690909d8f9dc3c30ea94
SSDEEP 98304:enAQff5+yN0EDi026vPOLGxJJJG65Cvuqa8Xa1zm5GruKx48Lvq19wc:eL5T1PpJy65CvuHBh0Hjkvq19wc
TLSH
T14D06F1357AA2C072D7323230969DA37AE7BDB9309B75529726D01D3C2E705C2993C26F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 12KB
SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
MD5 3adf5e8387c828f62f12d2dd59349d63
SHA1 bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA512 e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
SSDEEP 6:BlcgEMS0gjjjjjjjjjjjjjjjjjjjjjjjjjjj/naEMh:TcNwezg
TLSH
T192423A021F61C274F2CC0CA44D58244CEF10CA5B211B02C54C75073597C06D73EFB35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG2.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
Size 12KB
SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
MD5 f35117734829b05cfceaa7e39b2b61fb
SHA1 342ae5f530dce669fedaca053bd15b47e755adc2
SHA512 1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
SSDEEP 3:y9lMll2/l0uqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdC:BlcI
TLSH
T128420404113000D5D1450175007471C5751547D5D004034C30114C14451047703CC044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
Size 12KB
SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
MD5 f5d6a81635291e408332cc01c565068f
SHA1 72fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA512 33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
SSDEEP 3:y9lMll2/l0ZVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTn:BlcSj
TLSH
T1DA42040F110103C5D1C700350C57C1C4F51F45357004035C1011CC344D10457034C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG9.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG
Size 438B
SHA256 4846e8abd45ebeed3cfed01d4ca47e3125bb812a34f0bb48a185205d0d43d441
MD5 35e4aa9f7e5c3afa0fb1b148c8e3b099
SHA1 e6b91abdec6976873ce43b0fb2b153a19d68d7c9
SHA512 8e5ef4b42a13fb724bbf076229fc470bd3d012af64fdb5a7ae0a33ef0d50781518c8ec19e40c5ff1c2c1afb316a9dedcc3f41f883adb6e2f3aa263d4c32d6b46
TLSH
T16FF0DCC21E507AA0C50F2A32DE19854A912754C72DA9336A9C05D6213380BC6A08A1A2
MD5 SHA1 SHA512 TLSH

Submit Download

IRZip.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Size 400KB
SHA256 4776d4c121e2294f1e6bca5a89525e4a451190c218244a1e34bcbf9f65b18fa5
MD5 a104fd7978c81c831f03eb8fd23fc5e4
SHA1 7643f972054f54c7856b40a9509b32e0ab52eca6
SHA512 95193fa53a18c5bfae845b6ae8a2e43da2f1bb81e98ea80ffe57113ac12826701cc84e52ed0d57f9ebb10a7281e4f8f6ea435269ec8c5688c34e09ec4e8b8d3e
SSDEEP 12288:/wji6+ZoE2oaXKOAilmVx+igEpONKiKjZTesV4:EiJTbaXlAUnKiKjJesV4
TLSH
T1D1949D01B6C1C0B2D1AD253124AAA3369A3E7D205735D7C3F79CFA7A5F311D1AA2934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wow64.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Size 252KB
SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
MD5 bfa121019a2dd9f7749f6bb72570319e
SHA1 fc48a96ad45e00815060bb366fe8f31c140ecb19
SHA512 cda75a55119104b23489b1048c810e066099b13e12aade7cfc757ba91de7b6754edff2da561741a16c92aa00d7e4ea0b53f77ebea6aaca059a74847a0f5d4059
SSDEEP 3072:52E6GukcxWtnwkwNBp0AUTjQzKgvyVx9QlllMS25RpaLSDk/wY:52EcxW2kwNBp5UTsKgaQllaMLl
TLSH
T15F444B0176C4C032D27B21354877D375AA7ABD618BB48287BBDCAA7B5F705C28A37316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.8MB
SHA256 bfc627e9a28022487107ef0eb8c9d083495faccf7d62ad232d265f64c113f935
MD5 64641dcff8291c7e6e66bb65107366e7
SHA1 25cd228c75682180684c12162032da00b388695c
SHA512 637e3273f162da5f2c38be5717f02d0abce14ac4038fd99930c15e740005db27b8d07a55d8f73a41e568fd2edf792128329075886b9a3300cb03e918d223a21f
SSDEEP 24576:Ca1CQfAjA0BfBo58XGN6dYKVJGMFmMjPdJdneiaTcRenXHpwILvdcggwX6/Sar3S:Ca1zoR5GUg+PdJsia4kXH5LvHX6/ljS
TLSH
T123853329F205AD7DE27C4A732938851F9847BE47BC2C570A16D87C9AC8763058F42A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 395KB
SHA256 22eb6f08accb3c20caa7a7240aa094467204918d2a797b5c6905bea3f2361677
MD5 bfb686060b227113dcfb04026a6d4b1a
SHA1 c50c21b067993906f3f2c7193d95e265410eab49
SHA512 593996b709194a7e58d14b0232d0d4ef86b2adcb88177a48206b30a47730a7ad514752cff4e559dee5aebeec4fa58a5e348ed02b646c508166b4114052270cb8
SSDEEP 12288:J3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pUVh:QaLbwKLDTH5+6pUVh
TLSH
T1DE84BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1636-494-0x0000000000B70000-0x0000000001170000-memory.dmp

Download

memory/1636-520-0x0000000000B70000-0x0000000001170000-memory.dmp

Download

memory/1636-10-0x0000000000B70000-0x0000000001170000-memory.dmp

Download

memory/1636-549-0x0000000000B70000-0x0000000001170000-memory.dmp

Download

memory/1636-550-0x0000000000B70000-0x0000000001170000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads