Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/08/2026, 07:47
General
- Target Iris-Installer-3.3.0.exe
- Size 1.7MB
- Sample260828-jmpp6svsdx
- SHA256 8a94127581a7a160fd1cecd67f1a1172c2e806ad6c79c7f18eb626b5c8bf5f7b
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Iris-Installer-3.3.0.exe"C:\Users\Admin\AppData\Local\Temp\Iris-Installer-3.3.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-version"2⤵
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\fab1A64.tmp" "-fabricInstallerBootstrap" "true"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\reg.exereg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
fab1A64.tmp
flatlaf-windows-x86_64-5692003424200.dll
memory/1320-31-0x000002B027000000-0x000002B027001000-memory.dmp
memory/1320-18-0x000002B0288C0000-0x000002B028B30000-memory.dmp
memory/1320-39-0x000002B027000000-0x000002B027001000-memory.dmp
memory/1320-83-0x000002B027000000-0x000002B027001000-memory.dmp
memory/1320-91-0x000002B027000000-0x000002B027001000-memory.dmp
memory/1320-110-0x000002B027000000-0x000002B027001000-memory.dmp
memory/1320-111-0x000002B027000000-0x000002B027001000-memory.dmp
memory/1320-120-0x000002B0288C0000-0x000002B028B30000-memory.dmp
memory/1440-13-0x0000026BA4C30000-0x0000026BA4EA0000-memory.dmp
memory/1440-2-0x0000026BA4C30000-0x0000026BA4EA0000-memory.dmp
memory/1440-12-0x0000026BA3340000-0x0000026BA3341000-memory.dmp