Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 03:04
General
- Target 1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6.exe
- Size 9.3MB
- Sample260814-dkv7aabm8v
- SHA256 1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6.exe"C:\Users\Admin\AppData\Local\Temp\1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HB6LA.tmp\1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6.tmp"C:\Users\Admin\AppData\Local\Temp\is-HB6LA.tmp\1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6.tmp" /SL5="$A022C,8763332,965120,C:\Users\Admin\AppData\Local\Temp\1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Notepad==\Notepad==.exe"C:\Users\Admin\AppData\Local\Programs\Notepad==\Notepad==.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Notepad==.exe
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
scrlbar.tcl
spinbox.tcl
text.tcl
tk.tcl
button.tcl
cursors.tcl
entry.tcl
fonts.tcl
menubutton.tcl
notebook.tcl
panedwindow.tcl
progress.tcl
scale.tcl
scrollbar.tcl
ttk.tcl
utils.tcl
_tkinter.pyd
_wmi.pyd
base_library.zip
libffi-8.dll
python312.dll
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
ucrtbase.dll
zlib1.dll
1836b809b2724c4718899f3a3b513ab5a8c6fd7b81cca83cc96e0c228bba51b6.tmp
memory/2600-1-0x0000000000F80000-0x000000000107A000-memory.dmp
memory/2600-8-0x0000000000F80000-0x000000000107A000-memory.dmp
memory/2600-2025-0x0000000000F80000-0x000000000107A000-memory.dmp
memory/4312-12-0x0000000000710000-0x0000000000A69000-memory.dmp
memory/4312-9-0x0000000000710000-0x0000000000A69000-memory.dmp
memory/4312-10-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/4312-1004-0x0000000000710000-0x0000000000A69000-memory.dmp
memory/4312-6-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/4312-2024-0x0000000000710000-0x0000000000A69000-memory.dmp
memory/4852-2063-0x00007FFC95310000-0x00007FFC95339000-memory.dmp