Analysis
- max time kernel
152s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 18:29
General
- Target Suspect Support Tool.exe
- Size 78.5MB
- Sample260913-w4xtbssakb
- SHA256 910cfa66040103396bab1e3f48fc4c0fef58ddf3f5e9b567a158e2f768134b28
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 4 IoCs
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 19 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Costura .NET executable packer 2 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Suspect Support Tool.exe"C:\Users\Admin\AppData\Local\Temp\Suspect Support Tool.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\TempFold\vcredist_15.22_x86.exe"C:\TempFold\vcredist_15.22_x86.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1798E1F2-8BE7-4764-A7EA-DEC5DA114599}\.cr\vcredist_15.22_x86.exe"C:\Windows\Temp\{1798E1F2-8BE7-4764-A7EA-DEC5DA114599}\.cr\vcredist_15.22_x86.exe" -burn.clean.room="C:\TempFold\vcredist_15.22_x86.exe" -burn.filehandle.attached=596 -burn.filehandle.self=6963⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\TempFold\vcredist_15.22_x64.exe"C:\TempFold\vcredist_15.22_x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F9E616A3-C599-42F5-AD9C-BBBF42BD8114}\.cr\vcredist_15.22_x64.exe"C:\Windows\Temp\{F9E616A3-C599-42F5-AD9C-BBBF42BD8114}\.cr\vcredist_15.22_x64.exe" -burn.clean.room="C:\TempFold\vcredist_15.22_x64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=6963⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\TempFold\vcredist_2013_x86.exe"C:\TempFold\vcredist_2013_x86.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\TempFold\vcredist_2013_x86.exe"C:\TempFold\vcredist_2013_x86.exe" -burn.unelevated BurnPipe.{757ECF26-D18A-4BB7-9C92-C1B641DCB31A} {11E52AA6-E51F-4EC8-8A79-1A721AF074C8} 55083⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\TempFold\vcredist_2013_x64.exe"C:\TempFold\vcredist_2013_x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\TempFold\vcredist_2013_x64.exe"C:\TempFold\vcredist_2013_x64.exe" -burn.unelevated BurnPipe.{66EB886B-FC9A-4E58-BB88-D1D03A73BD65} {02FE0008-AA0C-4818-AF54-4CD1D20FD694} 12723⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vcredist_15.22_x64.exe
vcredist_15.22_x86.exe
vcredist_2013_x64.exe
vcredist_2013_x86.exe
wixstdba.dll
vcredist_15.22_x86.exe
logo.png
wixstdba.dll
thm.wxl
vcredist_15.22_x64.exe
memory/1312-21-0x00000000112F0000-0x00000000112FE000-memory.dmp
memory/1312-28-0x0000000011790000-0x0000000011798000-memory.dmp
memory/1312-16-0x000000000C1E0000-0x000000000C1EA000-memory.dmp
memory/1312-15-0x000000000C010000-0x000000000C02E000-memory.dmp
memory/1312-14-0x000000000BFA0000-0x000000000BFC2000-memory.dmp
memory/1312-19-0x0000000075770000-0x00000000759FA000-memory.dmp
memory/1312-0-0x0000000000400000-0x0000000006394000-memory.dmp
memory/1312-22-0x0000000011320000-0x000000001133A000-memory.dmp
memory/1312-23-0x0000000011340000-0x00000000113EC000-memory.dmp
memory/1312-24-0x0000000011550000-0x0000000011584000-memory.dmp
memory/1312-25-0x0000000011590000-0x00000000116DA000-memory.dmp
memory/1312-26-0x00000000113F0000-0x00000000113FA000-memory.dmp
memory/1312-27-0x0000000011400000-0x000000001140A000-memory.dmp
memory/1312-17-0x0000000010080000-0x00000000100E6000-memory.dmp
memory/1312-29-0x0000000011D70000-0x00000000120CB000-memory.dmp
memory/1312-13-0x000000000B360000-0x000000000B3D6000-memory.dmp
memory/1312-12-0x000000000B2C0000-0x000000000B352000-memory.dmp
memory/1312-11-0x000000000AD00000-0x000000000B2BA000-memory.dmp
memory/1312-10-0x000000000AB90000-0x000000000AC42000-memory.dmp
memory/1312-9-0x0000000075770000-0x00000000759FA000-memory.dmp
memory/1312-8-0x0000000000400000-0x0000000006394000-memory.dmp
memory/1312-6-0x0000000000400000-0x0000000006394000-memory.dmp
memory/1312-5-0x0000000000400000-0x0000000006394000-memory.dmp
memory/1312-4-0x0000000075770000-0x00000000759FA000-memory.dmp
memory/1312-1-0x00000000758BE000-0x00000000758BF000-memory.dmp