Analysis
- user interaction
yes - max time kernel
26s - max time network
28s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
18/08/2026, 21:33
General
- Target setup.exe
- Size 5.1MB
- Sample260818-1ect3shq4v
- SHA256 187e4966caab8a325d975f9ba4265d2f754009ae52001932486234511901552f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3B3VQ.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3B3VQ.tmp\setup.tmp" /SL5="$D01F0,4813689,153088,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 9683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 9683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3304 -ip 33041⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
setup.tmp
BASS.dll
ISDone.dll
VclStylesInno.dll
bp.dll
memory/3304-61-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-57-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/3304-22-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-21-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-60-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/3304-26-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-31-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-38-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-65-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-72-0x0000000000400000-0x0000000000583000-memory.dmp
memory/3304-84-0x00000000745E0000-0x0000000074630000-memory.dmp
memory/3304-96-0x0000000000400000-0x0000000000583000-memory.dmp
memory/3304-95-0x0000000000400000-0x0000000000583000-memory.dmp
memory/3304-97-0x0000000000400000-0x0000000000583000-memory.dmp
memory/3304-101-0x0000000004C10000-0x0000000004C39000-memory.dmp
memory/3304-100-0x0000000004B90000-0x0000000004C06000-memory.dmp
memory/3304-25-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-99-0x00000000047B0000-0x00000000049D5000-memory.dmp
memory/3304-91-0x0000000004C10000-0x0000000004C39000-memory.dmp
memory/3304-20-0x0000000003DE0000-0x0000000003DE1000-memory.dmp
memory/3304-17-0x00000000047B0000-0x00000000049D5000-memory.dmp
memory/3304-77-0x0000000004B90000-0x0000000004C06000-memory.dmp
memory/3304-8-0x0000000000400000-0x0000000000583000-memory.dmp
memory/3304-71-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-70-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-69-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/3304-68-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-67-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-66-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/3304-64-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-63-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/3304-7-0x0000000000400000-0x0000000000583000-memory.dmp
memory/3304-24-0x0000000003DF0000-0x0000000003DF1000-memory.dmp
memory/3304-23-0x0000000000400000-0x0000000000583000-memory.dmp
memory/3304-33-0x0000000003E20000-0x0000000003E21000-memory.dmp
memory/3304-59-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-56-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-54-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/3304-53-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-52-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-51-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/3304-50-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-49-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-48-0x0000000004B10000-0x0000000004B11000-memory.dmp
memory/3304-47-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-46-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-45-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/3304-44-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-41-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-40-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-39-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/3304-62-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-37-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-55-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-36-0x0000000003E30000-0x0000000003E31000-memory.dmp
memory/3304-35-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-34-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-58-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-32-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-43-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-42-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/3304-29-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-28-0x0000000003C80000-0x0000000003DC0000-memory.dmp
memory/3304-27-0x0000000003E00000-0x0000000003E01000-memory.dmp
memory/3304-30-0x0000000003E10000-0x0000000003E11000-memory.dmp
memory/3512-0-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3512-2-0x000000000041E000-0x000000000041F000-memory.dmp
memory/3512-102-0x0000000000400000-0x0000000000430000-memory.dmp