Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
27/08/2026, 12:24
General
- Target LocalOffice_Agent.exe
- Size 36.0MB
- Sample260827-plhhcstscx
- SHA256 bf525b66522ac13aa81d5390f1cc35f26252bd79b4e8d52828a0ba27ecd67818
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LocalOffice_Agent.exe"C:\Users\Admin\AppData\Local\Temp\LocalOffice_Agent.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{6BF4062B-AC6F-4F20-8811-E26F192397AF}\LocalOffice_Agent.exeC:\Users\Admin\AppData\Local\Temp\{6BF4062B-AC6F-4F20-8811-E26F192397AF}\LocalOffice_Agent.exe -package:"C:\Users\Admin\AppData\Local\Temp\LocalOffice_Agent.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{6BF4062B-AC6F-4F20-8811-E26F192397AF}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{6BF4062B-AC6F-4F20-8811-E26F192397AF}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{6BF4062B-AC6F-4F20-8811-E26F192397AF}\Disk1\LocalOffice_Agent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EE89C2FD-E4C0-4DB2-9894-C2BD04D1F4CD}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A16816B1-E850-42CF-8215-697CF0640D19}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{69308C1D-10B2-4028-8CB1-64F9C7F471C8}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1667473-7FDA-4688-85E2-3FFA6AED4CC2}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{64C779C7-FE6B-44C6-B53C-E0B12A3F42C2}3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{F52915E7-D883-44DA-9DA8-BA75C3B01001}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4A7A16FF-4FCD-4D26-8A4E-EC647FFA3F49}3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C C:\Windows\Temp\agentInstallerComponent.exe "C:\Users\Admin\AppData\Local\Temp\LocalOffice_Agent.exe" 3 > C:\Windows\Temp\DesktopCentralAgent.txt 2>&13⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\agentInstallerComponent.exeC:\Windows\Temp\agentInstallerComponent.exe "C:\Users\Admin\AppData\Local\Temp\LocalOffice_Agent.exe" 34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0x0409.ini
ISSetup.dll
LocalOffice_Agent.exe
data1.cab
data1.hdr
layout.bin
setup.inx
setup.ini
ISBEW64.exe
DIFxData.ini
FontData.ini
_isres_0x0409.dll
_isuser_0x0409.dll
isrt.dll
agentInstallerComponent.exe
memory/3740-96-0x0000000006970000-0x0000000006B37000-memory.dmp
memory/3740-90-0x0000000010000000-0x0000000010114000-memory.dmp
memory/3740-91-0x00000000065B0000-0x00000000065B2000-memory.dmp
memory/3740-140-0x0000000010000000-0x0000000010114000-memory.dmp