63fac7a61eddee415e9d405258271acac654485b2233a5decea6eee736c4f6a2

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7bfefd879a4cfd9f52f672b60958edf2.exe
Size 2.1MB
Sample260830-lay47a1epc
SHA256 63fac7a61eddee415e9d405258271acac654485b2233a5decea6eee736c4f6a2
MD5 7bfefd879a4cfd9f52f672b60958edf2
SHA1 b30175d9775bc317d7761d1a4859ea625d081afe
SHA512 2fc2fd82582cb4649de7676f0464cda193976e8c306832057d28ed8dc57f0594c0ebca6f02e72f5cca19e40da447e7f30485b1388626fab17460e9feeae74254
SSDEEP 24576:GXVrSLScusMmOvjjhzvLTCY6eDvoe2iUd+Sh97V6K8pmFH7BPNQ3ArPkBJultjKC:puI2hFUe2foSL3rdf/rVltjkg
TLSH
T10AA5D03FB28B653EE06E5A367A76E220583B7A6165124C16D7F4C88CCF251701E3F786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Executes dropped EXE 4 IoCs

pid	Process
1504	7bfefd879a4cfd9f52f672b60958edf2.tmp
552	7bfefd879a4cfd9f52f672b60958edf2.tmp
1052	launch.exe
6096	service.exe

Loads dropped DLL 2 IoCs

pid	Process
1052	launch.exe
6096	service.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	launch.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bfefd879a4cfd9f52f672b60958edf2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bfefd879a4cfd9f52f672b60958edf2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bfefd879a4cfd9f52f672b60958edf2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bfefd879a4cfd9f52f672b60958edf2.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4084-1-0x0000000000DD0000-0x0000000000EAC000-memory.dmp	innosetup
behavioral2/memory/6796-11-0x0000000000DD0000-0x0000000000EAC000-memory.dmp	innosetup
behavioral2/memory/4084-12-0x0000000000DD0000-0x0000000000EAC000-memory.dmp	innosetup
behavioral2/memory/6796-58-0x0000000000DD0000-0x0000000000EAC000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1052	launch.exe
1052	launch.exe
1052	launch.exe
1052	launch.exe
6096	service.exe
6096	service.exe
6096	service.exe
6096	service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
552	7bfefd879a4cfd9f52f672b60958edf2.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1052	launch.exe
6096	service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1504	4084	7bfefd879a4cfd9f52f672b60958edf2.exe	90
PID 1504 wrote to memory of 6796	1504	7bfefd879a4cfd9f52f672b60958edf2.tmp	91
PID 6796 wrote to memory of 552	6796	7bfefd879a4cfd9f52f672b60958edf2.exe	92
PID 552 wrote to memory of 1052	552	7bfefd879a4cfd9f52f672b60958edf2.tmp	93
PID 552 wrote to memory of 6096	552	7bfefd879a4cfd9f52f672b60958edf2.tmp	94

C:\Users\Admin\AppData\Local\Temp\7bfefd879a4cfd9f52f672b60958edf2.exe
"C:\Users\Admin\AppData\Local\Temp\7bfefd879a4cfd9f52f672b60958edf2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\is-YNUKG5WB50.tmp\7bfefd879a4cfd9f52f672b60958edf2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-YNUKG5WB50.tmp\7bfefd879a4cfd9f52f672b60958edf2.tmp" /SL5="$401CE,967745,842240,C:\Users\Admin\AppData\Local\Temp\7bfefd879a4cfd9f52f672b60958edf2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\7bfefd879a4cfd9f52f672b60958edf2.exe
    "C:\Users\Admin\AppData\Local\Temp\7bfefd879a4cfd9f52f672b60958edf2.exe" /PASSWORD=XhACj636RE7rfE9i
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\is-BPKAKC9I6N.tmp\7bfefd879a4cfd9f52f672b60958edf2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BPKAKC9I6N.tmp\7bfefd879a4cfd9f52f672b60958edf2.tmp" /SL5="$501CE,967745,842240,C:\Users\Admin\AppData\Local\Temp\7bfefd879a4cfd9f52f672b60958edf2.exe" /PASSWORD=XhACj636RE7rfE9i
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\966f57d9ebdbbbe81b9f1a235e2191bd.log\launch.exe
        
        "C:\Users\Admin\AppData\Local\Temp\966f57d9ebdbbbe81b9f1a235e2191bd.log\launch.exe" -Embedding
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\259fcd7533d3fd0cd744d7069e4d3b3b.log\service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\259fcd7533d3fd0cd744d7069e4d3b3b.log\service.exe" -Embedding
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GameuxInstallHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\259fcd7533d3fd0cd744d7069e4d3b3b.log\GameuxInstallHelper.dll
Size 101KB
SHA256 e7fa33b28432ccee53a6ecbe886dbb13843816b5ef923d4b0100db1dfb60803a
MD5 71a6bcad5222b860cb7eba92f481aafe
SHA1 c3982fc4a7c5d04e95920598b73744b0eef7669f
SHA512 b09ef7ff68c057605c88a6e6aa4a39d39e1bdd3cead685c329c9a79453a61e4caebfca43bb8faa4c53dbca4c677ede1367ca3583ba12cd809d96cc8aaaa5b35b
SSDEEP 1536:OTzAYHiSZEreLFcxubcXykLj+aVdvNuhnMJmjfIOcs8WNrO:OfAYCkLOyaykLjLj4zjRcs8WI
TLSH
T14DA35C85EBC340F2E53B55F08CDBA7BF863173224475CDFAE68CAB45B923711164628A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.exe

Path C:\Users\Admin\AppData\Local\Temp\259fcd7533d3fd0cd744d7069e4d3b3b.log\service.exe
Size 104KB
SHA256 13eede1261f4b2e523d585729870ef010d97d22fdea371c592a3c4e9127fb755
MD5 525bef62adbdcfa8c821af2e8272866b
SHA1 c00c2f5e053d05b449779618971dfbd41bcb534d
SHA512 7eeb52b0574a2ffc838f32a6b58ae2a3374d88804ac54642583927858ddb3a8b2307f6650165fef5ff6871a225e185bf4366d76e859bbcb704f5707d893d6769
SSDEEP 1536:qhSUvJEGEfSySB59j+I3eTw/b7jZFVc5D4BtTGYywBu3Phk57lMmv7vvao7:wT+fSrbInY3eD4Btn2PwRMmvuE
TLSH
T18EA39D527B90D071E0622A3099A9C6718F377C329B79C5CB37947E6E3EB13C1A935326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameuxInstallHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\966f57d9ebdbbbe81b9f1a235e2191bd.log\GameuxInstallHelper.dll
Size 101KB
SHA256 ada190cb878d1088780832a2f817d185a525242ad068bd27e87b84b79bb5793c
MD5 8862e72c9796a7cfa69e77930cab3bf6
SHA1 687fa7bcecc25ff833b56929cc366780f05e6064
SHA512 23eacadbc0118e1a719165b318ddbc49ebe694e727d154151b721bb1326c2b608b0540d4c26efafe60a4e22afaafe4e8bf1b35aa00ed68a0d9f4b6b7ba03c80d
SSDEEP 1536:ogLfkYHbSbEvDfKcYT28WyXrPMaVd/2uvNMULUQIOkJ8aQ7:5DkY7PftLDyXrPVjldUGkJ8aI
TLSH
T131A36C81EAC380F1E83B59F08DDBA7BF8231B3224579CDFAE58C5F45B9237112585299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.exe

Path C:\Users\Admin\AppData\Local\Temp\966f57d9ebdbbbe81b9f1a235e2191bd.log\launch.exe
Size 104KB
SHA256 a826b52219cf7ba60fbd9773db29630ed80946327d2829c64d16a523041c9dda
MD5 973d8db3c07f1ad65ec0c94f07dc3194
SHA1 6d60ee242e901f4e8203af602941c81a44eb7d45
SHA512 b9a691bfca3de31fbfba2c02a952de8d3b5a349abd1e946513023f8e1064d2c0f55b5e0f3b5a34278f934fe3f5ea8641ff4066f97a6cafe9d1fcf2fbe6d9ac2e
SSDEEP 1536:FhSUvJEGEfSySB59j+I3eTw/b7jZFVc5D4BtTGYywBu3PA6Q8qRYAmeMs32:jT+fSrbInY3eD4Btn2PTT4Yxs32
TLSH
T1F2A38D423B90D471E0522A305965C6714F3B7C32ABB985CB37947EAE7EB13C1A936327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bfefd879a4cfd9f52f672b60958edf2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-YNUKG5WB50.tmp\7bfefd879a4cfd9f52f672b60958edf2.tmp
Size 4.1MB
SHA256 13178f09ffa080714a6f678fabb00329271aa04bcd0c14eca59bccf5c9225a03
MD5 a58b1ec6afd0fc4b542778237ee6fe58
SHA1 de76d51ecd1260c72d325c7107753b13aab4836b
SHA512 97bd0202582aeb41338246469493c1939a81ea91662a3a7322d3df003ec27113eccba2183cad1703519736b48aa5a543da0dd09b9a71813ac446774d09cd8915
SSDEEP 98304:t9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jv333J:CItJj90Z6RgKwq
TLSH
T1B4168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr_initsetup.log

Path C:\Users\Admin\AppData\Local\Temp\scr_initsetup.log
Size 76B
SHA256 5a1d42bde74b0657b976355d2b36c77498f889604b590d779cc4780512296b4f
MD5 aea3762c9e9062bd4dfcf1c8cb3d2103
SHA1 e5b55d7219e98c5864c46ba974c70becb5949928
SHA512 02c044b97c42e795c7416493f2c7131ae068b028a7609eb48dffcac1f5cbef548af441f8cee7db201be23ffd8900ee4b32320b0460654f241c2981673559876e
TLSH
T193A0023D5C475DB7B015509181A470DD73810C4C45411400145548771944BC3D40C656
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-57-0x0000000000960000-0x0000000000D97000-memory.dmp

Download

memory/552-18-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/1052-59-0x0000000000650000-0x0000000000654000-memory.dmp

Download

memory/1052-77-0x0000000002380000-0x00000000023F8000-memory.dmp

Download

memory/1052-97-0x0000000073740000-0x0000000073761000-memory.dmp

Download

memory/1052-78-0x0000000002380000-0x00000000023F8000-memory.dmp

Download

memory/1052-70-0x0000000002380000-0x00000000023F8000-memory.dmp

Download

memory/1052-72-0x0000000002380000-0x00000000023F8000-memory.dmp

Download

memory/1052-76-0x0000000002380000-0x00000000023F8000-memory.dmp

Download

memory/1504-10-0x0000000000F40000-0x0000000001377000-memory.dmp

Download

memory/1504-6-0x0000000001C00000-0x0000000001C01000-memory.dmp

Download

memory/4084-12-0x0000000000DD0000-0x0000000000EAC000-memory.dmp

Download

memory/4084-1-0x0000000000DD0000-0x0000000000EAC000-memory.dmp

Download

memory/6096-88-0x0000000002990000-0x0000000002A08000-memory.dmp

Download

memory/6096-60-0x0000000000590000-0x0000000000594000-memory.dmp

Download

memory/6096-90-0x0000000002990000-0x0000000002A08000-memory.dmp

Download

memory/6096-94-0x0000000002990000-0x0000000002A08000-memory.dmp

Download

memory/6096-95-0x0000000002990000-0x0000000002A08000-memory.dmp

Download

memory/6096-96-0x0000000002990000-0x0000000002A08000-memory.dmp

Download

memory/6096-98-0x0000000075410000-0x0000000075431000-memory.dmp

Download

memory/6796-58-0x0000000000DD0000-0x0000000000EAC000-memory.dmp

Download

memory/6796-11-0x0000000000DD0000-0x0000000000EAC000-memory.dmp

Download