Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 03:33
General
- Target c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.exe
- Size 3.8MB
- Sample260826-d4ezeayvc1
- SHA256 c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca
Malware Config
Signatures
- Modifies RDP port number used by Windows 1 TTPs
- Executes dropped EXE 6 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.exe"C:\Users\Admin\AppData\Local\Temp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E05CFNSCP7.tmp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.tmp"C:\Users\Admin\AppData\Local\Temp\is-E05CFNSCP7.tmp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.tmp" /SL5="$6004E,2754392,842240,C:\Users\Admin\AppData\Local\Temp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.exe"C:\Users\Admin\AppData\Local\Temp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.exe" /PASSWORD=ur5psgkCGSa8yP9L3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NF1UVZIMUR.tmp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.tmp"C:\Users\Admin\AppData\Local\Temp\is-NF1UVZIMUR.tmp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.tmp" /SL5="$7004E,2754392,842240,C:\Users\Admin\AppData\Local\Temp\c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.exe" /PASSWORD=ur5psgkCGSa8yP9L4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bc59d1f15707fbc70c3927c8abb94a5b.bak\worker.exe"C:\Users\Admin\AppData\Local\Temp\bc59d1f15707fbc70c3927c8abb94a5b.bak\worker.exe" -Embedding5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\0d2ed29548ce375de8c9db0bc4f75f58.dat\update.exe"C:\Users\Admin\AppData\Local\Temp\0d2ed29548ce375de8c9db0bc4f75f58.dat\update.exe" -Embedding5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\ProgramData\SystemCertificates\673855f0f228de61\a.exeC:\ProgramData\SystemCertificates\673855f0f228de61\a.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Crypto\ad6b2e0d0e4d851a\d.exeC:\ProgramData\Crypto\ad6b2e0d0e4d851a\d.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a25055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
index.dat
index.dat
index.dat~RFe59d603.TMP
update.exe
worker.exe
c4932c0133d5372f8b4236a08eeedbb0348deddf4062c5c247344f54a205e2ca.tmp
scr_initsetup.log
memory/1468-6-0x0000000001100000-0x0000000001101000-memory.dmp
memory/1468-9-0x0000000000850000-0x0000000000C87000-memory.dmp
memory/4348-12-0x0000000000740000-0x000000000081C000-memory.dmp
memory/4348-0-0x0000000000740000-0x000000000081C000-memory.dmp
memory/4920-1160-0x0000000000740000-0x000000000081C000-memory.dmp
memory/4920-10-0x0000000000740000-0x000000000081C000-memory.dmp
memory/5436-1126-0x0000000000760000-0x0000000000B97000-memory.dmp
memory/5436-17-0x00000000014A0000-0x00000000014A1000-memory.dmp
memory/5816-3226-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3212-0x0000000010000000-0x0000000010133000-memory.dmp
memory/5816-3247-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3193-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3195-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3199-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3200-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3201-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3246-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5816-3238-0x00000000041D0000-0x000000000421D000-memory.dmp
memory/5816-3217-0x0000000002C50000-0x0000000002CC8000-memory.dmp
memory/5908-3022-0x0000000002BA0000-0x0000000002C18000-memory.dmp
memory/5908-2906-0x0000000002BA0000-0x0000000002C18000-memory.dmp
memory/5908-2911-0x0000000002BA0000-0x0000000002C18000-memory.dmp
memory/5908-3112-0x0000000002BA0000-0x0000000002C18000-memory.dmp
memory/5908-3057-0x0000000002BA0000-0x0000000002C18000-memory.dmp
memory/5908-3179-0x0000000002BA0000-0x0000000002C18000-memory.dmp