Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 02:52
Behavioral task
behavioral1
Sample
961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.exe
- Size 6.6MB
- Sample260908-dc6ytabq6v
- SHA256 961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90
- MD5 924888854d8334e390bedb54f9924b7a
- SHA1 d624238ee624764bcc17a18cfd9c2abb3ee114bf
- SHA512 8797138704848b2462312c0af878b1bf6b0d61637898800f32b96da343b42818bdf911526be0cb1f0c843a1b800186c32ed02108e2158d7de9a0db885ff593af
- SSDEEP 98304:4+ON9oYKmpxPJQvetYp2RxSKXZFCKjTFk7+mewg5R8FbvnUfnUYOWOst3s/I0X+y:4+XKj6qsWZfFkGwAcUSdst8/I0X+3Af
- TLSH T15366017F72A4D12AE96DC13AC5A2AA14B933B0711B33C5EFD1E402699B075E40F7E364
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2760 961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/5908-0-0x0000000000580000-0x00000000006EE000-memory.dmp innosetup behavioral2/memory/5908-6-0x0000000000580000-0x00000000006EE000-memory.dmp innosetup - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5908 wrote to memory of 2760 5908 961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.exe"C:\Users\Admin\AppData\Local\Temp\961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\is-QA0GGYXBPG.tmp\961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.tmp"C:\Users\Admin\AppData\Local\Temp\is-QA0GGYXBPG.tmp\961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.tmp" /SL5="$B0036,5316555,1412608,C:\Users\Admin\AppData\Local\Temp\961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.exe"2⤵
- Executes dropped EXE
PID:2760
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-QA0GGYXBPG.tmp\961e258729a0831f774202ce023f9e6670314fd9db6a448a25b4ab474dafcb90.tmp
- Size 6.6MB
- SHA256 9cf756ad8ca7e679473af389318b97fd88372dab06c803910fa3ff158feae5d3
- MD5 1270bc6ea707a3bd0ce336e86a178826
- SHA1 64b2a93625d3963a6da14845b5418b3960a7a3c2
- SHA512 1f76409ee4235c9bbe4117e648f3900766b61f0ae1accb6ff3070a1a9b3ff7630f0b2676c614ca00457322f55e83c8ad4067349f78db177b258b333a5b8ce0f5
- SSDEEP 49152:BADme7cxJlvoPYlGseQWOrGg2YJluDEShV16wnxN5aJIDSSgHV9qeCJcwHnJhUM1:BYmkcxJ9/WUEYJ0VzW8hJH9XM2H13339
- TLSH T1D8665B6B72E4C22DD16EC23EC5A78F44E533B0B5173BC2EB529002951F1AAD49E7E670
- MD5 SHA1 SHA512 SSDEEP TLSH