81041292f487cbbb94a69a539f626e4f0bbf9c9b5aeabb360630f51b6f29bcb0

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedGiant Activation Service Unlocker 2024.1.1.exe
Size 6.0MB
Sample260815-1gr2satgnb
SHA256 81041292f487cbbb94a69a539f626e4f0bbf9c9b5aeabb360630f51b6f29bcb0
MD5 aaa25d8889e758325f07a222dde95cfb
SHA1 b184be92215ee836d4d01d25e1b6365e32ca7d3f
SHA512 aee53941c6495cda06e0b598bf5298d632b9b39f7e5e56d8dc7b07c8e5d566571fa09916b545b0cfbcad348de76851b62713d5fa8c5ad97f5b913180cd8daed0
SSDEEP 98304:awEUNLNbrBlj5CPI7MyXXW4+Bqz0W5Gqj3YGAS8I4kXUGV:aJWnjTXWgFGqrpASwkX3
TLSH
T1ED56122BB259A73DD1BA0A32467382509E3B76657B378C2F47F42CCCDF261411E3A646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3536	RedGiant Activation Service Unlocker 2024.1.1.tmp
5692	deep.exe
2204	deep.tmp

Loads dropped DLL 2 IoCs

pid	Process
3536	RedGiant Activation Service Unlocker 2024.1.1.tmp
2204	deep.tmp

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Red Giant\Services\Red Giant Service.exe	deep.tmp
File created	C:\Program Files\Red Giant\Services\is-TMV9U.tmp	deep.tmp

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2024.1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2024.1.1.tmp

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1196-0-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c45a-18.dat	innosetup
behavioral2/memory/1196-19-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup
behavioral2/memory/5692-22-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup
behavioral2/memory/5692-36-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup
behavioral2/memory/1196-38-0x0000000000400000-0x00000000004DE000-memory.dmp	innosetup

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1636	timeout.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5060	taskkill.exe
4184	taskkill.exe
2512	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3536	RedGiant Activation Service Unlocker 2024.1.1.tmp
3536	RedGiant Activation Service Unlocker 2024.1.1.tmp
2204	deep.tmp
2204	deep.tmp

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3536	RedGiant Activation Service Unlocker 2024.1.1.tmp
2204	deep.tmp

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3536	1196	RedGiant Activation Service Unlocker 2024.1.1.exe	89
PID 3536 wrote to memory of 1472	3536	RedGiant Activation Service Unlocker 2024.1.1.tmp	90
PID 1472 wrote to memory of 5312	1472	net.exe	92
PID 3536 wrote to memory of 1636	3536	RedGiant Activation Service Unlocker 2024.1.1.tmp	93
PID 3536 wrote to memory of 5964	3536	RedGiant Activation Service Unlocker 2024.1.1.tmp	95
PID 5964 wrote to memory of 2200	5964	net.exe	97
PID 3536 wrote to memory of 5060	3536	RedGiant Activation Service Unlocker 2024.1.1.tmp	98
PID 3536 wrote to memory of 4184	3536	RedGiant Activation Service Unlocker 2024.1.1.tmp	101
PID 3536 wrote to memory of 5692	3536	RedGiant Activation Service Unlocker 2024.1.1.tmp	103
PID 5692 wrote to memory of 2204	5692	deep.exe	104
PID 2204 wrote to memory of 2512	2204	deep.tmp	105
PID 3536 wrote to memory of 2196	3536	RedGiant Activation Service Unlocker 2024.1.1.tmp	107
PID 2196 wrote to memory of 3208	2196	net.exe	109

C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2024.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2024.1.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\is-SLHGB.tmp\RedGiant Activation Service Unlocker 2024.1.1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-SLHGB.tmp\RedGiant Activation Service Unlocker 2024.1.1.tmp" /SL5="$200254,5336498,842240,C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2024.1.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "Red Giant Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Red Giant Service"
      4⤵
      PID:5312
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop mxredirect
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mxredirect
      4⤵
      PID:2200
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "RGContentService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "MxNotify.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\is-O223N.tmp\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\is-O223N.tmp\deep.exe" /verysilent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\is-4UBR9.tmp\deep.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4UBR9.tmp\deep.tmp" /SL5="$C0064,4136551,842240,C:\Users\Admin\AppData\Local\Temp\is-O223N.tmp\deep.exe" /verysilent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im maxon.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" start "Red Giant Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Red Giant Service"
      4⤵
      PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-O223N.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

deep.exe

Path C:\Users\Admin\AppData\Local\Temp\is-O223N.tmp\deep.exe
Size 4.9MB
SHA256 13da5838d34068c64778dc760c6367f503cbcbf4ea03b77dbfcaa3ae98f6e5f8
MD5 7fa6f27addd0c8d5108c1b2740fb6ab2
SHA1 95a82b6cdb0168f6247dbde9f27e1f734b6f9080
SHA512 a802c13fbe22e1478901bd66c70a0f781907324982c4dd53be39e5e63ab87457670128eac014430f3760f5f9d94c07f77bde0bf91f6d3e53ce90ef1a555fa2e7
SSDEEP 98304:axhhPk4EiGgUN7mLbJdzMMRXefBB37AS8I4kXUGV:axhhTbUNsTzM2eJB37ASwkX3
TLSH
T13636022BB268673ED5BE4632467382209D3B76617B338C2E16F02DCCDF255811E3E656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGiant Activation Service Unlocker 2024.1.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-SLHGB.tmp\RedGiant Activation Service Unlocker 2024.1.1.tmp
Size 3.1MB
SHA256 29d22b0353fbe2d218b80809876a7ad148bc89e799f2a631a0c80bac5f8476fe
MD5 8222e671fc0008ee8ebd72878c42aaac
SHA1 e2007831545f753cb4f45bd9ed6cb8ab6f860aa6
SHA512 f7b6ccb50891243a033788becf360e9f3475f07a12edd8bd68910f036bb21cf5351659dda4141f756a087039534e9e1a818d6810d953c00013c7442a8ccffd00
SSDEEP 49152:1Cqmbwum1aSIocnWl6mcXFnTE95Ct8w/2+TSB333l:klGle9E95Ct8p333l
TLSH
T18FE54B17F38C673EC0AA1A36453BC2549937B7A169128D57ABFC390C8F752842E3E746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-19-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/1196-0-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/1196-38-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/2204-35-0x0000000000400000-0x0000000000726000-memory.dmp

Download

memory/3536-6-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/3536-21-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/3536-20-0x0000000000400000-0x0000000000726000-memory.dmp

Download

memory/3536-37-0x0000000000400000-0x0000000000726000-memory.dmp

Download

memory/5692-22-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/5692-36-0x0000000000400000-0x00000000004DE000-memory.dmp

Download