Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/09/2026, 23:28
General
- Target setup.exe
- Size 7.6MB
- Sample260901-3f2kyazamb
- SHA256 b4f92fca39fafda19a267f22e7492f5ca8a42bb969f9124ced8120b150ad7737
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 11 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-80P30.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-80P30.tmp\setup.tmp" /SL5="$400B0,7365806,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\is-K4HOA.tmp\fnr.exe arc.ini fgrplc -13⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-K4HOA.tmp\fnr.exeC:\Users\Admin\AppData\Local\Temp\is-K4HOA.tmp\fnr.exe arc.ini fgrplc -14⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-K4HOA.tmp\FlushFileCache.exe"C:\Users\Admin\AppData\Local\Temp\is-K4HOA.tmp\FlushFileCache.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
setup.tmp
BASS.dll
CallbackCtrl.dll
FlushFileCache.exe
ISDone.dll
MusicButton.png
arc.ini
botva2.dll
fnr.exe
idp.dll
innocallback.dll
wintb.dll
memory/4084-76-0x0000000000400000-0x000000000042D000-memory.dmp
memory/4084-0-0x0000000000400000-0x000000000042D000-memory.dmp
memory/4084-2-0x000000000041E000-0x000000000041F000-memory.dmp
memory/4788-97-0x0000000007290000-0x000000000729F000-memory.dmp
memory/4788-114-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-79-0x0000000003FE0000-0x0000000004045000-memory.dmp
memory/4788-77-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-88-0x0000000011000000-0x000000001104C000-memory.dmp
memory/4788-80-0x000000006B080000-0x000000006B08D000-memory.dmp
memory/4788-81-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-33-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-30-0x0000000003FE0000-0x0000000004045000-memory.dmp
memory/4788-104-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-106-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-111-0x0000000007290000-0x000000000729F000-memory.dmp
memory/4788-112-0x0000000011000000-0x000000001104C000-memory.dmp
memory/4788-108-0x0000000003FE0000-0x0000000004045000-memory.dmp
memory/4788-107-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-78-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-115-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-121-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-128-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-129-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-135-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-143-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-150-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-164-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-174-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-188-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-23-0x0000000003E60000-0x0000000003E75000-memory.dmp
memory/4788-9-0x0000000000400000-0x0000000000579000-memory.dmp
memory/4788-8-0x0000000000400000-0x0000000000579000-memory.dmp