Analysis
- user interaction
yes - max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/08/2026, 03:05
Behavioral task
behavioral1
Sample
latest.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
latest.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
latest.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
General
- Target latest.exe
- Size 6.7MB
- Sample260826-dlfg8abe65
- SHA256 b499acf5feaa0d6ccda07941e88be34fbfc4a1627c193e21d940a7688ae11644
- MD5 4764f66522d752f585386c63451f202c
- SHA1 c310beeae52ba850c984b2ee3fef57185807d523
- SHA512 a6d0e33595e02cfc828a82eab3a2e7cfce054cde0b805cbae76822d72250dadeea1ac172c4ab192713e3c3a8cc977dbb1669982b450d33c2970a636cd5d60658
- SSDEEP 196608:mRCUIexSc2lzbI4sGW9usRpkCsaMnXRc4YTJ92Pz:2sQPgsGKuGGaMnXJYd9y
- TLSH T10E66223FB268653EC56A1B724A738320997B7F61741B8C1E07F0280CCF765726E3A659
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2344 latest.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\ArkServerManager\is-20HFN.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-C40JB.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-URDUS.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-AML8T.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Diagnostics.Tracing.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Diagnostics.Tools.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Runtime.Handles.dll latest.tmp File created C:\Program Files\ArkServerManager\is-N6JCG.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-10GAT.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-DAVVR.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-QEJ15.tmp latest.tmp File created C:\Program Files\ArkServerManager\Globalization\pt-BR\is-V2DS9.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Net.NameResolution.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Runtime.Serialization.Formatters.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Threading.Thread.dll latest.tmp File created C:\Program Files\ArkServerManager\is-2VHRJ.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-14P35.tmp latest.tmp File created C:\Program Files\ArkServerManager\es\is-OT91H.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Globalization.Extensions.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Globalization.dll latest.tmp File created C:\Program Files\ArkServerManager\is-8OEO9.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-NUI6L.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Runtime.CompilerServices.VisualC.dll latest.tmp File created C:\Program Files\ArkServerManager\is-VHJS1.tmp latest.tmp File created C:\Program Files\ArkServerManager\GameData\is-CQMSL.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Diagnostics.Debug.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.ObjectModel.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Threading.ThreadPool.dll latest.tmp File created C:\Program Files\ArkServerManager\is-SPI3E.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-2R3S6.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-IEBAG.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-QNJGE.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Net.Http.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Xml.XmlSerializer.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\Newtonsoft.Json.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.IO.FileSystem.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Net.WebSockets.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Security.Claims.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Security.Cryptography.Csp.dll latest.tmp File created C:\Program Files\ArkServerManager\is-3H2DF.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\Microsoft.Extensions.Configuration.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Resources.Reader.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Reactive.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Runtime.Numerics.dll latest.tmp File created C:\Program Files\ArkServerManager\is-LGSJD.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-COTCN.tmp latest.tmp File created C:\Program Files\ArkServerManager\Art\is-FLCPH.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\it\Microsoft.Win32.TaskScheduler.resources.dll latest.tmp File created C:\Program Files\ArkServerManager\is-I7LH1.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-RAM1V.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-GS4HR.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-3D91R.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-HANL2.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-E6UIH.tmp latest.tmp File created C:\Program Files\ArkServerManager\is-SL4FT.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\Microsoft.Extensions.Configuration.Binder.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\ru\Microsoft.Win32.TaskScheduler.resources.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Diagnostics.FileVersionInfo.dll latest.tmp File created C:\Program Files\ArkServerManager\is-SDN16.tmp latest.tmp File opened for modification C:\Program Files\ArkServerManager\Discord.Net.Interactions.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Buffers.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.IO.FileSystem.Primitives.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\System.Runtime.Serialization.Json.dll latest.tmp File opened for modification C:\Program Files\ArkServerManager\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll latest.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language latest.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language latest.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral4/memory/5076-0-0x0000000000400000-0x00000000004CE000-memory.dmp innosetup behavioral4/memory/5076-7-0x0000000000400000-0x00000000004CE000-memory.dmp innosetup behavioral4/memory/5076-381-0x0000000000400000-0x00000000004CE000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2344 latest.tmp 2344 latest.tmp - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2344 latest.tmp - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5076 wrote to memory of 2344 5076 latest.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\latest.exe"C:\Users\Admin\AppData\Local\Temp\latest.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\is-2IS6B.tmp\latest.tmp"C:\Users\Admin\AppData\Local\Temp\is-2IS6B.tmp\latest.tmp" /SL5="$60258,6133920,791552,C:\Users\Admin\AppData\Local\Temp\latest.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2344
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\ArkServerManager\is-D3F3S.tmp
- Size 7.5MB
- SHA256 53aaf17d9bb7bdaae7d4475cf2525fcf8ee048314ac8cecb91eee2e553cce2e7
- MD5 9713f952bf05dad97bb5642ca19f9d27
- SHA1 6c9282c83a1359ba14927e4b31189e1d61bfa45a
- SHA512 03fe3e7c22a70c8859cdf2c3e0ad34387c7f300508e1e55c0c34545060aa4c3c3656600304b84fa1a33d1078613b53be3d481e6c56b4b81ac5109c5a459c6e35
- SSDEEP 98304:MXAIekZ+NXP8X8MP8cFXWHIPIsIIfIIIW/7qjiefcZm7W:MXAIekwGWHIPIsIIfIIIW/Pm7W
- TLSH T1E576A5DEA684CC7DE6EC4AB1F611C9F8DB22AF00C1B4426B2799FE36387554364D6C06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-2IS6B.tmp\latest.tmp
- Size 3.0MB
- SHA256 7f0ceaa6e19e389577deea41bb5130225de948ae18e382ba51afeb0ffb932c87
- MD5 e9446720e97812c0be02abf98229c549
- SHA1 1f432b23174b2966e7ba8e937b78db59ac6e422e
- SHA512 8c16870b012c88386ed7f7b7d28e2f2b10c86200397c8b8b66e2b2a9943ddebf7e2409886deaad277f4f965d12138a1e1f055c4ead528d026f2607e8c320ba9e
- SSDEEP 49152:xWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbz333Z8:TtLutqgwh4NYxtJpkxhGQ333i
- TLSH T15CE53A17F28C713ED06B3A364A3385909837FA6169168C2797FC794C8F365942E3E64B
- MD5 SHA1 SHA512 SSDEEP TLSH