Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/08/2026, 12:17
General
- Target 48c207da82b98b1fa7c505139c6ab57e54feca44d1d8e608320b618e29e14b99.exe
- Size 9.3MB
- Sample260825-pgfg7shr3w
- SHA256 48c207da82b98b1fa7c505139c6ab57e54feca44d1d8e608320b618e29e14b99
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 16 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 35 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\48c207da82b98b1fa7c505139c6ab57e54feca44d1d8e608320b618e29e14b99.exe"C:\Users\Admin\AppData\Local\Temp\48c207da82b98b1fa7c505139c6ab57e54feca44d1d8e608320b618e29e14b99.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7EE4D18-89FF-4A78-A7D3-704F189546E9}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A4AA19D-5B84-4EE0-9DDD-B77AA9AE9ABE}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4206CFE8-E3C5-42FE-8A87-646497593F41}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{274DD8BE-AE05-494D-A78C-8BDED9BFCA8F}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A457D12E-6274-4FB8-9FA2-16527BE5B4F1}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71EE4B99-3FFE-408D-883C-950DACB3C0BA}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3263EF7-03D6-42AB-BF4A-FC8EB13944C5}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D4A6982-C997-44AE-B1D2-78D1943D6C0C}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{262EA4BD-2425-4E61-9804-2BC805FEA5E9}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{422B8CC5-F3C8-47EA-B590-0B0BA9DC1938}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{820F7EB7-D24F-4D40-9FAB-8EA2101B4B1E}2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D4AF46D9-4AF1-4B89-B4BD-CE0CCBEF1A03}2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\checknet.bat C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\ > "C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Free Windows Tools\DesktopCentralFreeWindowsTools\logs\checknet_err.txt" 2>&12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript checknet.vbs3⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\TestInjecter.bat "C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Free Windows Tools\DesktopCentralFreeWindowsTools" C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\InjectId.exe C:\Users\Admin\AppData\Local\Temp\48c207da82b98b1fa7c505139c6ab57e54feca44d1d8e608320b618e29e14b99.exe > "C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Free Windows Tools\DesktopCentralFreeWindowsTools\logs\InjecterId.txt" 2>&12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\InjectId.exeC:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\InjectId.exe -r C:\Users\Admin\AppData\Local\Temp\48c207da82b98b1fa7c505139c6ab57e54feca44d1d8e608320b618e29e14b99.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://www.manageengine.com/products/free-windows-tools/readme.html?Did=2014-10-29-08-152⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.manageengine.com/products/free-windows-tools/readme.html?Did=2014-10-29-08-153⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3444 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\FreeTool.bat C:\PROGRA~2\MANAGE~1\MANAGE~1\FREEWI~1\DESKTO~1 > "C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Free Windows Tools\DesktopCentralFreeWindowsTools\logs\szLogFile.txt" 2>&12⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~2\MANAGE~1\MANAGE~1\FREEWI~1\DESKTO~1\bin\ManageEngine_Launcher.exeManageEngine_Launcher.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{6A889EA1-BF84-4B58-B19F-C54E5965112F}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{6A889EA1-BF84-4B58-B19F-C54E5965112F}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9E6FB7B7-977F-4E28-8EB9-25D7ED3A4799}4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Launcher\Launcher.exe"C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Launcher\Launcher.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\{94F83DD2-35F7-4EEB-9C05-B2ED9829E348}\{6B371D2F-7AAD-432D-A8C9-A46CC34FE026}\InstallTools.bat "C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Free Windows Tools\DesktopCentralFreeWindowsTools" > "C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Free Windows Tools\DesktopCentralFreeWindowsTools\installtools.txt" 2>&12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\ManageEngine Free Tools\Free Windows Tools\DesktopCentralFreeWindowsTools\bin\LaunchPad.exeLaunchPad.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
data1.cab
data83cc.rra
layout.bin
setup.exe
data1.cab
data9dec.rra
layout.bin
setu9dfb.rra
setup.ini
DownloadDetail.txt
Link.txt
InjecterInfo.txt
LaunchPad.exe
ManageEngine_Launcher.exe
BottomPane.jpg
topband.jpg
Launcher.exe
Launcher.exe.config
toolresources.resources
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
imagestore.dat
favicon[1].ico
suggestions[1].en-US
ISSetup.dll
_Setup.dll
setup.ini
ISBEW64.exe
core9b1d.rra
DIFxData.ini
FontData.ini
VASData.ini
_IsRes.dll
defa9b2d.rra
isrt.dll
setup.inx
ISBEW64.exe
FreeTool.bat
InstallTools.bat
checknet.bat
DIFxData.ini
FontData.ini
InjectId.exe
ShowRegistrationForm.dll
TestInjecter.bat
_isres_0x0409.dll
checknet.vbs
isrt.dll
0x0409.ini
ISSetup.dll
setup.inx
setup.ini
memory/1844-932-0x00000000053B0000-0x0000000005442000-memory.dmp
memory/1844-950-0x0000000005390000-0x000000000539A000-memory.dmp
memory/1844-930-0x0000000000970000-0x00000000009AA000-memory.dmp
memory/1844-931-0x0000000005960000-0x0000000005F04000-memory.dmp
memory/1972-541-0x0000000005510000-0x0000000005599000-memory.dmp
memory/1972-444-0x00000000020E0000-0x0000000002105000-memory.dmp
memory/1972-459-0x0000000002610000-0x00000000027AA000-memory.dmp
memory/1972-546-0x0000000005250000-0x00000000052D8000-memory.dmp
memory/4924-203-0x00000000028E0000-0x0000000002ACE000-memory.dmp
memory/4924-166-0x00000000055C0000-0x0000000005649000-memory.dmp
memory/4924-205-0x0000000000BE0000-0x0000000000BE2000-memory.dmp
memory/4924-158-0x00000000051F0000-0x0000000005297000-memory.dmp
memory/4924-161-0x0000000000BE0000-0x0000000000BE2000-memory.dmp
memory/4924-977-0x00000000051F0000-0x0000000005297000-memory.dmp
memory/4924-976-0x00000000028E0000-0x0000000002ACE000-memory.dmp
memory/4924-204-0x00000000051F0000-0x0000000005297000-memory.dmp
memory/4924-160-0x00000000051F0000-0x0000000005297000-memory.dmp
memory/4924-279-0x00000000028E0000-0x0000000002ACE000-memory.dmp
memory/4924-207-0x00000000051F0000-0x0000000005297000-memory.dmp
memory/4924-215-0x00000000028E0000-0x0000000002ACE000-memory.dmp
memory/4924-20-0x00000000028E0000-0x0000000002ACE000-memory.dmp
memory/4924-1001-0x00000000051F0000-0x0000000005297000-memory.dmp
memory/4924-1000-0x00000000028E0000-0x0000000002ACE000-memory.dmp
memory/4924-216-0x00000000051F0000-0x0000000005297000-memory.dmp
memory/4924-23-0x00000000028E0000-0x0000000002ACE000-memory.dmp
memory/4924-25-0x0000000000630000-0x0000000000632000-memory.dmp