Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 05:55
General
- Target auslogics-windows-slimmer-setup.exe
- Size 23.4MB
- Sample260820-gmt9jsbf52
- SHA256 7d272e536dfb41f0619a3702863560c69468c4ad53c418f81d320d22c5ac18dd
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 51 IoCs
- Drops file in Windows directory 2 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 26 IoCs
- Suspicious use of SendNotifyMessage 23 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\auslogics-windows-slimmer-setup.exe"C:\Users\Admin\AppData\Local\Temp\auslogics-windows-slimmer-setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-79AV0.tmp\auslogics-windows-slimmer-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-79AV0.tmp\auslogics-windows-slimmer-setup.tmp" /SL5="$4012A,24038918,505856,C:\Users\Admin\AppData\Local\Temp\auslogics-windows-slimmer-setup.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe" /install /setautostart3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe" /FromInstall3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\WindowsSlimmer.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\WindowsSlimmer.exe"2⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F512DD74-0038-4A13-9ABF-55BD1272EC77\dismhost.exeC:\Users\Admin\AppData\Local\Temp\F512DD74-0038-4A13-9ABF-55BD1272EC77\dismhost.exe {5AC0F795-3DA8-4BC3-B55D-9D6B4EDEB2B8}3⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\TabReports.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\TabReports.exe" /NoActivate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\TabMakePortable.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\TabMakePortable.exe" /NoActivate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\TabCareCenter.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\TabCareCenter.exe" /NoActivate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Auslogics\Windows Slimmer\ActionCenter.exe"C:\Program Files (x86)\Auslogics\Windows Slimmer\ActionCenter.exe" /NoActivate2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
CommonForms.Routine2.dll
main.ini
Integrator.exe
RescueCenterHelper.dll
TaskSchedulerHelper.dll
WindowsSlimmer.exe
auslogics-windows-slimmer-setup.tmp
AxComponentsRTL.bpl
AxComponentsVCL.bpl
BrowserHelper.dll
CFAHelper.dll
CommonForms.Site.dll
GoogleAnalyticsHelper.dll
Localizer.dll
SetupCustom.dll
enu.lng
rtl250.bpl
sqlite3.dll
vcl250.bpl
vclimg250.bpl
dism.log
memory/1356-297-0x0000000001350000-0x00000000013AA000-memory.dmp
memory/1356-331-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/1356-299-0x00000000013B0000-0x0000000001CAF000-memory.dmp
memory/1356-323-0x00000000075D0000-0x000000000765B000-memory.dmp
memory/1356-327-0x0000000007680000-0x000000000772E000-memory.dmp
memory/1356-318-0x00000000074E0000-0x0000000007514000-memory.dmp
memory/1356-306-0x0000000007360000-0x0000000007381000-memory.dmp
memory/1356-305-0x0000000007360000-0x0000000007381000-memory.dmp
memory/1356-329-0x0000000000400000-0x0000000000964000-memory.dmp
memory/1356-330-0x0000000050050000-0x0000000050A76000-memory.dmp
memory/1356-332-0x0000000001070000-0x0000000001343000-memory.dmp
memory/1356-334-0x00000000013B0000-0x0000000001CAF000-memory.dmp
memory/1356-333-0x0000000001350000-0x00000000013AA000-memory.dmp
memory/1356-295-0x0000000001070000-0x0000000001343000-memory.dmp
memory/4616-364-0x0000000001160000-0x0000000001B86000-memory.dmp
memory/4616-362-0x0000000000E20000-0x00000000010F3000-memory.dmp
memory/4616-387-0x0000000007380000-0x00000000073B4000-memory.dmp
memory/4616-378-0x0000000007350000-0x0000000007371000-memory.dmp
memory/4616-377-0x0000000007350000-0x0000000007371000-memory.dmp
memory/4616-363-0x0000000001100000-0x000000000115A000-memory.dmp
memory/5060-288-0x0000000005770000-0x00000000057A4000-memory.dmp
memory/5060-292-0x0000000007930000-0x0000000007B25000-memory.dmp
memory/5060-289-0x0000000005AC0000-0x0000000005B01000-memory.dmp
memory/5060-290-0x0000000005BA0000-0x0000000005BBB000-memory.dmp
memory/5060-59-0x0000000000400000-0x000000000058B000-memory.dmp
memory/5060-50-0x0000000004020000-0x000000000407A000-memory.dmp
memory/5060-53-0x0000000004080000-0x000000000497F000-memory.dmp
memory/5060-291-0x0000000005BC0000-0x0000000005BE5000-memory.dmp
memory/5060-67-0x0000000005770000-0x00000000057A4000-memory.dmp
memory/5060-33-0x0000000003CA0000-0x0000000003ED8000-memory.dmp
memory/5060-285-0x0000000004020000-0x000000000407A000-memory.dmp
memory/5060-281-0x0000000000400000-0x000000000058B000-memory.dmp
memory/5060-282-0x0000000003CA0000-0x0000000003ED8000-memory.dmp
memory/5060-284-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/5060-286-0x0000000004080000-0x000000000497F000-memory.dmp
memory/5060-76-0x0000000005AC0000-0x0000000005B01000-memory.dmp
memory/5060-287-0x0000000004980000-0x00000000053A6000-memory.dmp
memory/5060-283-0x0000000050000000-0x00000000502D3000-memory.dmp
memory/5060-56-0x0000000004980000-0x00000000053A6000-memory.dmp
memory/5060-6-0x0000000002370000-0x0000000002371000-memory.dmp
memory/5060-349-0x0000000000400000-0x000000000058B000-memory.dmp
memory/5060-352-0x0000000050A80000-0x0000000050E72000-memory.dmp
memory/5060-356-0x0000000004980000-0x00000000053A6000-memory.dmp
memory/5060-350-0x0000000003CA0000-0x0000000003ED8000-memory.dmp
memory/5060-351-0x0000000050000000-0x00000000502D3000-memory.dmp
memory/5060-89-0x0000000005BC0000-0x0000000005BE5000-memory.dmp
memory/5060-354-0x0000000004080000-0x000000000497F000-memory.dmp
memory/5060-107-0x0000000002370000-0x0000000002371000-memory.dmp
memory/5060-94-0x0000000007930000-0x0000000007B25000-memory.dmp
memory/5060-84-0x0000000005BA0000-0x0000000005BBB000-memory.dmp
memory/5724-389-0x0000000007590000-0x000000000763E000-memory.dmp
memory/5724-376-0x0000000007490000-0x00000000074C4000-memory.dmp
memory/5724-391-0x0000000007720000-0x000000000784B000-memory.dmp
memory/5724-390-0x0000000007640000-0x0000000007681000-memory.dmp
memory/5724-346-0x0000000001140000-0x0000000001B66000-memory.dmp
memory/5724-388-0x0000000007570000-0x000000000758B000-memory.dmp
memory/5724-393-0x0000000007A50000-0x0000000007C58000-memory.dmp
memory/5724-395-0x0000000007D10000-0x0000000007D97000-memory.dmp
memory/5724-392-0x0000000007A20000-0x0000000007A45000-memory.dmp
memory/5724-366-0x0000000007460000-0x0000000007481000-memory.dmp
memory/5724-394-0x0000000007C60000-0x0000000007CEB000-memory.dmp
memory/5724-367-0x0000000007460000-0x0000000007481000-memory.dmp
memory/5724-342-0x0000000000E00000-0x00000000010D3000-memory.dmp
memory/5724-344-0x00000000010E0000-0x000000000113A000-memory.dmp
memory/6068-57-0x0000000000400000-0x0000000000485000-memory.dmp
memory/6068-1-0x0000000000400000-0x0000000000485000-memory.dmp