Analysis
- max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 00:15
General
- Target setup_katana_zero_1.0.5_(30035).exe
- Size 175.9MB
- Sample260827-akb7mayamf
- SHA256 bdcebe6b1337d638c2570d9781583fffff590c060afca21ede8493b7174de412
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 33 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_katana_zero_1.0.5_(30035).exe"C:\Users\Admin\AppData\Local\Temp\setup_katana_zero_1.0.5_(30035).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7GTS7.tmp\setup_katana_zero_1.0.5_(30035).tmp"C:\Users\Admin\AppData\Local\Temp\is-7GTS7.tmp\setup_katana_zero_1.0.5_(30035).tmp" /SL5="$5020C,183845417,192512,C:\Users\Admin\AppData\Local\Temp\setup_katana_zero_1.0.5_(30035).exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
setup_katana_zero_1.0.5_(30035).tmp
1207658714_english.jpg
1439474400_english.jpg
BigOK.png
EULAAccepted.png
EULAShow.png
background.jpg
botva2.dll
btn_md5.png
crcdll.dll
error.png
innocallback.dll
ok.png
slideshow.ini
uninstall.dll
eula.txt
memory/748-144-0x0000000006690000-0x000000000669E000-memory.dmp
memory/748-163-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-17-0x00000000053A0000-0x0000000005457000-memory.dmp
memory/748-139-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/748-140-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/748-214-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-215-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-141-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-11-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-143-0x00000000053A0000-0x0000000005457000-memory.dmp
memory/748-142-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-146-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-153-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-152-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-155-0x0000000006690000-0x000000000669E000-memory.dmp
memory/748-158-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-164-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-62-0x0000000006690000-0x000000000669E000-memory.dmp
memory/748-169-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-175-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-176-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-181-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-187-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-186-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-192-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-5-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/748-197-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-198-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-203-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-204-0x0000000005280000-0x0000000005295000-memory.dmp
memory/748-208-0x0000000000320000-0x0000000000472000-memory.dmp
memory/748-209-0x0000000005280000-0x0000000005295000-memory.dmp
memory/4456-138-0x0000000000A10000-0x0000000000A49000-memory.dmp
memory/4456-0-0x0000000000A10000-0x0000000000A49000-memory.dmp