Analysis
- user interaction
yes - max time kernel
298s - max time network
204s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/09/2026, 22:52
General
- Target Setup.exe
- Size 3.5MB
- Sample260907-2tdklahn21
- SHA256 019209ff4301e84efb20536b8fcf5483af4964d6a6e4fc35071f7dbd8fb0a5b6
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 23 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H6KV8.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-H6KV8.tmp\Setup.tmp" /SL5="$402DC,2841108,780800,C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe" /LANG=English3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-I46NQ.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-I46NQ.tmp\Setup.tmp" /SL5="$F0302,2841108,780800,C:\Users\Admin\AppData\Local\Temp\Setup.exe" /LANG=English4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PNQKL.tmp\CLS-LOLZ_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-PNQKL.tmp\CLS-LOLZ_x64.exe" d - - -idx=005⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-PNQKL.tmp\CLS-SREP_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-PNQKL.tmp\CLS-SREP_x64.exe" d - - -idx=005⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
C:\Games\Kaiju Princess\fmpu.exe"C:\Games\Kaiju Princess\fmpu.exe" -d5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4CNLU4V7.bat" "C:\Games\Kaiju Princess\fmpu.exe" -d"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qbE5A3634.56\vorb.exe"C:\Users\Admin\AppData\Local\Temp\\qbE5A3634.56\vorb" "C:\Games\Kaiju Princess\KaijuPrincess_Data\resources.FMP" "C:\Games\Kaiju Princess\KaijuPrincess_Data\resources.FMPDAT"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\qbE5A3634.56\vorb.exe"C:\Users\Admin\AppData\Local\Temp\\qbE5A3634.56\vorb" "C:\Games\Kaiju Princess\KaijuPrincess_Data\resources.FMPDAT" "C:\Games\Kaiju Princess\KaijuPrincess_Data\resources.FMPDAT"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\qbE5A3634.56\hp.exe"C:\Users\Admin\AppData\Local\Temp\\qbE5A3634.56\hp" "C:\Games\Kaiju Princess\KaijuPrincess_Data\resources.FMPDAT" "C:\Games\Kaiju Princess\KaijuPrincess_Data\resources.DIFFF" "C:\Games\Kaiju Princess\KaijuPrincess_Data\resources.resource"7⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Games\Kaiju Princess\rm.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
resources.DIFFF
resources.FMPDAT
Compat.browser
DefaultWsdlHelpGenerator.aspx
fmpu.exe
rm.bat
4CNLU4V7.bat
CallbackCtrl.dll
ISDone.dll
VCLSTYLESINNO.DLL
cmdout.dll
Setup.tmp
ARC.INI
CLS-LOLZ.DLL
CLS-LOLZ_X64.EXE
CLS-OGG.DLL
CLS-SREP3.DLL
CLS-SREP_X64.EXE
CLS.INI
FACOMPRESS.DLL
RECORDS.INI
SETTINGS.INI
SKIN.VSF
UNARC.DLL
hp.exe
vorb.exe
memory/1708-338-0x0000000073C50000-0x0000000073C57000-memory.dmp
memory/1708-223-0x0000000007860000-0x0000000007B9A000-memory.dmp
memory/1708-749-0x0000000061080000-0x0000000061122000-memory.dmp
memory/1708-196-0x00000000034F0000-0x000000000350F000-memory.dmp
memory/1708-347-0x0000000073BD0000-0x0000000073BD7000-memory.dmp
memory/1708-335-0x0000000061080000-0x0000000061122000-memory.dmp
memory/1708-344-0x0000000073BE0000-0x0000000073BE7000-memory.dmp
memory/1708-277-0x0000000007860000-0x0000000007B9A000-memory.dmp
memory/1708-750-0x0000000073C50000-0x0000000073C57000-memory.dmp
memory/1708-759-0x0000000073BE0000-0x0000000073BE7000-memory.dmp
memory/1708-214-0x0000000007860000-0x0000000007B9A000-memory.dmp
memory/2512-647-0x0000000140000000-0x0000000140057000-memory.dmp
memory/2512-360-0x0000000140000000-0x0000000140057000-memory.dmp
memory/3972-683-0x0000000000400000-0x0000000000518000-memory.dmp
memory/4200-676-0x0000000000400000-0x0000000000518000-memory.dmp
memory/4200-679-0x0000000000400000-0x0000000000518000-memory.dmp
memory/4292-99-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/4292-0-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/4388-694-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/4388-667-0x0000000000400000-0x00000000004CE000-memory.dmp
memory/5840-54-0x0000000007F30000-0x0000000007F31000-memory.dmp
memory/5840-93-0x0000000008000000-0x0000000008001000-memory.dmp
memory/5840-87-0x0000000007FE0000-0x0000000007FE1000-memory.dmp
memory/5840-86-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-85-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-84-0x0000000007FD0000-0x0000000007FD1000-memory.dmp
memory/5840-83-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-82-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-81-0x0000000007FC0000-0x0000000007FC1000-memory.dmp
memory/5840-80-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-79-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-77-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-92-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-76-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-75-0x0000000007FA0000-0x0000000007FA1000-memory.dmp
memory/5840-74-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-73-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-72-0x0000000007F90000-0x0000000007F91000-memory.dmp
memory/5840-71-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-70-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-68-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-67-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-66-0x0000000007F70000-0x0000000007F71000-memory.dmp
memory/5840-65-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-64-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-62-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-78-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
memory/5840-69-0x0000000007F80000-0x0000000007F81000-memory.dmp
memory/5840-60-0x0000000007F50000-0x0000000007F51000-memory.dmp
memory/5840-98-0x00000000079A0000-0x0000000007CDA000-memory.dmp
memory/5840-89-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-90-0x0000000007FF0000-0x0000000007FF1000-memory.dmp
memory/5840-91-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-94-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-95-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-88-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-63-0x0000000007F60000-0x0000000007F61000-memory.dmp
memory/5840-61-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-42-0x0000000003790000-0x0000000003791000-memory.dmp
memory/5840-45-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/5840-46-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-47-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-48-0x00000000037B0000-0x00000000037B1000-memory.dmp
memory/5840-49-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-50-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-51-0x0000000007F20000-0x0000000007F21000-memory.dmp
memory/5840-52-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-55-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-56-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-57-0x0000000007F40000-0x0000000007F41000-memory.dmp
memory/5840-58-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-59-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-53-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-44-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-43-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-35-0x0000000003770000-0x0000000003771000-memory.dmp
memory/5840-36-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-38-0x0000000003780000-0x0000000003781000-memory.dmp
memory/5840-39-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-40-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-41-0x00000000079A0000-0x0000000007CDA000-memory.dmp
memory/5840-37-0x0000000007CE0000-0x0000000007E20000-memory.dmp
memory/5840-34-0x00000000079A0000-0x0000000007CDA000-memory.dmp
memory/5840-23-0x0000000003630000-0x000000000364F000-memory.dmp
memory/5840-5-0x00000000009C0000-0x00000000009C1000-memory.dmp
memory/5840-24-0x0000000003630000-0x000000000364F000-memory.dmp
memory/5840-12-0x0000000003610000-0x000000000362B000-memory.dmp
memory/5840-25-0x0000000003630000-0x000000000364F000-memory.dmp
memory/5840-26-0x000000000364C000-0x000000000364E000-memory.dmp
memory/5840-18-0x0000000010000000-0x0000000010009000-memory.dmp
memory/5940-691-0x00007FF735400000-0x00007FF735463000-memory.dmp
memory/5940-686-0x00007FF735400000-0x00007FF735463000-memory.dmp