Analysis
- user interaction
yes - max time kernel
120s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-es - resource tags
- submitted
31/08/2026, 18:12
General
- Target RHI-Setup.exe
- Size 24.9MB
- Sample260831-wtmklsdr91
- SHA256 c3e325cabe2c056010c9f0dc6f6a2cefbe7e85f6ea99935bfac573162f03e9e2
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 20 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Program Files directory 42 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies Control Panel 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RHI-Setup.exe"C:\Users\Admin\AppData\Local\Temp\RHI-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ODPS5RW5KI.tmp\RHI-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ODPS5RW5KI.tmp\RHI-Setup.tmp" /SL5="$400A6,24431562,1208320,C:\Users\Admin\AppData\Local\Temp\RHI-Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\RHI\RHI.exe"C:\Program Files\RHI\RHI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"explorer.exe" "C:\Program Files\RHI\RHI.DropHelper.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe"C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe" e "C:\Users\Admin\AppData\Local\RHI\reshade\ReShade_Setup_6.8.0_Addon.exe" -o"C:\Users\Admin\AppData\Local\Temp\RHI_reshade_a90364ebaa184cfcaaeba4e18e507b73" "ReShade64.dll" -y -r4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe"C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe" e "C:\Users\Admin\AppData\Local\RHI\reshade\ReShade_Setup_6.8.0_Addon.exe" -o"C:\Users\Admin\AppData\Local\Temp\RHI_reshade_b7f0a35fe11843a394fab6cad3d33956" "ReShade32.dll" -y -r4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe"C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe" e "C:\Users\Admin\AppData\Local\RHI\reshade-normal\ReShade_Setup_6.8.0.exe" -o"C:\Users\Admin\AppData\Local\Temp\RHI_reshade_156c89ffda214718b0cd8091e3a9cde3" "ReShade64.dll" -y -r4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe"C:\Users\Admin\AppData\Local\Temp\.net\RHI\rP_HzUXoC6Zn\7z.exe" e "C:\Users\Admin\AppData\Local\RHI\reshade-normal\ReShade_Setup_6.8.0.exe" -o"C:\Users\Admin\AppData\Local\Temp\RHI_reshade_9aeee6101f234ecc82c2ea279e1be6f5" "ReShade32.dll" -y -r4⤵
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\RHI\RHI.DropHelper.exe"C:\Program Files\RHI\RHI.DropHelper.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RHI.DropHelper.dll
RHI.DropHelper.exe
RHI.DropHelper.runtimeconfig.json
is-0Y74CBL7MU.tmp
is-D5NL9W3PBR.tmp
session_2026-08-31_19-13-40.txt
session_2026-08-31_19-13-40.txt
ReShade_Setup_6.8.0.exe
ReShade_Setup_6.8.0_Addon.exe
RHI.ico
7z.dll
7z.dll
7z.dll
7z.exe
7z.exe
CoreMessagingXP.dll
MRM.dll
Microsoft.DirectManipulation.dll
Microsoft.InputStateManager.dll
Microsoft.Internal.FrameworkUdk.dll
Microsoft.UI.Composition.OSSupport.dll
Microsoft.UI.Input.dll
Microsoft.UI.Windowing.Core.dll
Microsoft.UI.Windowing.dll
Microsoft.UI.Xaml.Controls.dll
Microsoft.UI.Xaml.Internal.dll
Microsoft.UI.dll
Microsoft.Windows.ApplicationModel.Resources.dll
Microsoft.WindowsAppRuntime.dll
Microsoft.ui.xaml.dll
RHI.dll
ReShade.Vulkan.ini
ReShade.ini
WinUIEdit.dll
dcompi.dll
dwmcorei.dll
marshal.dll
relimiter.ini
reshade.rdr2.ini
ReShade64.dll
ReShade32.dll
ReShade64.dll
ReShade32.dll
RHI-Setup.tmp
rhi_drop_hwnd.txt
memory/2004-12-0x0000000000010000-0x0000000000550000-memory.dmp
memory/2004-9-0x0000000000010000-0x0000000000550000-memory.dmp
memory/2004-10-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/2004-6-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/2004-405-0x0000000000010000-0x0000000000550000-memory.dmp
memory/2956-406-0x0000000000010000-0x0000000000145000-memory.dmp
memory/2956-1-0x0000000000010000-0x0000000000145000-memory.dmp
memory/2956-8-0x0000000000010000-0x0000000000145000-memory.dmp
memory/4764-403-0x00007FFBE4610000-0x00007FFBE4620000-memory.dmp