Analysis
- user interaction
yes - max time kernel
70s - max time network
75s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 12:24
General
- Target Setup.exe
- Size 10.8MB
- Sample260818-ple28sttbs
- SHA256 18a54512247fd0ab8f13be77a3065fd62c6c092004bb170849c55ce6eef254b5
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-954Q9.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-954Q9.tmp\Setup.tmp" /SL5="$40116,10464846,776704,C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Setup.tmp
BASS.dll
ISDone.dll
Settings.ini
SplitLib.dll
VclStylesInno.dll
memory/4276-1-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4276-100-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4844-78-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-64-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-25-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-26-0x0000000004050000-0x0000000004051000-memory.dmp
memory/4844-32-0x0000000004070000-0x0000000004071000-memory.dmp
memory/4844-35-0x0000000004080000-0x0000000004081000-memory.dmp
memory/4844-38-0x0000000004090000-0x0000000004091000-memory.dmp
memory/4844-41-0x00000000040A0000-0x00000000040A1000-memory.dmp
memory/4844-44-0x00000000040B0000-0x00000000040B1000-memory.dmp
memory/4844-47-0x00000000040C0000-0x00000000040C1000-memory.dmp
memory/4844-30-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-29-0x0000000004060000-0x0000000004061000-memory.dmp
memory/4844-31-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-59-0x0000000006810000-0x0000000006811000-memory.dmp
memory/4844-62-0x0000000006820000-0x0000000006821000-memory.dmp
memory/4844-65-0x0000000006830000-0x0000000006831000-memory.dmp
memory/4844-21-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-22-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-24-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-27-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-28-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-37-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-39-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-42-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-48-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-50-0x00000000040D0000-0x00000000040D1000-memory.dmp
memory/4844-56-0x0000000006800000-0x0000000006801000-memory.dmp
memory/4844-53-0x00000000067F0000-0x00000000067F1000-memory.dmp
memory/4844-67-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-68-0x0000000006840000-0x0000000006841000-memory.dmp
memory/4844-70-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-79-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-84-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-83-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-20-0x0000000004030000-0x0000000004031000-memory.dmp
memory/4844-76-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-89-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-75-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-23-0x0000000004040000-0x0000000004041000-memory.dmp
memory/4844-72-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-66-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-61-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-60-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-58-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-57-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-92-0x00000000739B0000-0x00000000739FD000-memory.dmp
memory/4844-55-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-54-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-52-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-51-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-49-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-45-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-46-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-43-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-40-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-36-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-77-0x0000000006870000-0x0000000006871000-memory.dmp
memory/4844-34-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-33-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-74-0x0000000006860000-0x0000000006861000-memory.dmp
memory/4844-69-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-73-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-82-0x000000000642E000-0x000000000642F000-memory.dmp
memory/4844-63-0x00000000065B0000-0x00000000066F0000-memory.dmp
memory/4844-71-0x0000000006850000-0x0000000006851000-memory.dmp
memory/4844-99-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-103-0x0000000002470000-0x0000000002471000-memory.dmp
memory/4844-104-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-105-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-106-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-107-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-108-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-18-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-115-0x00000000099E0000-0x0000000009A61000-memory.dmp
memory/4844-114-0x00000000099E0000-0x0000000009A61000-memory.dmp
memory/4844-120-0x00000000099E0000-0x0000000009A61000-memory.dmp
memory/4844-6-0x0000000002470000-0x0000000002471000-memory.dmp
memory/4844-143-0x0000000006290000-0x00000000065AA000-memory.dmp
memory/4844-144-0x0000000006290000-0x00000000065AA000-memory.dmp