Analysis
- user interaction
yes - max time kernel
149s - max time network
122s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
25/09/2026, 21:54
General
- Target MyDevAgent-Studio-Setup.exe
- Size 166.7MB
- Sample260925-1sgp7axeph
- SHA256 5061e67c4ee992c29efe8c06bab7f293f8f06c2d5ad305b4e3da11317e6ee79e
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/giovannisantorofrancesco2011-arch/MyDevAgent
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MyDevAgent-Studio-Setup.exe"C:\Users\Admin\AppData\Local\Temp\MyDevAgent-Studio-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H5V9JFI63Z.tmp\MyDevAgent-Studio-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-H5V9JFI63Z.tmp\MyDevAgent-Studio-Setup.tmp" /SL5="$1301F4,173452228,868864,C:\Users\Admin\AppData\Local\Temp\MyDevAgent-Studio-Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Programs\MyDevAgent Studio\extras\installa-mydevagent.ps1" -Pausa3⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python.exe" -c "import sys; print(sys.executable if sys.version_info >= (3, 10) else '')"4⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Programs\MyDevAgent Studio\bin\codium.cmd" --install-extension "C:\Users\Admin\AppData\Local\Programs\MyDevAgent Studio\extras\italiano.vsix" --force"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\MyDevAgent Studio\VSCodium.exe"C:\Users\Admin\AppData\Local\Programs\MyDevAgent Studio\bin\..\VSCodium.exe" "C:\Users\Admin\AppData\Local\Programs\MyDevAgent Studio\bin\..\resources\app\out\cli.js" --install-extension "C:\Users\Admin\AppData\Local\Programs\MyDevAgent Studio\extras\italiano.vsix" --force4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
package.json
extensions.json
extensions.json
codium.cmd
installa-mydevagent.ps1
icudtl.dat
is-3I2K59RKGM.tmp
is-XS6F493DQ4.tmp
node_modules.asar
windows.node
spdlog.node
winregistry.node
vscodium-policy-watcher.node
is-K4UM7O0GEV.tmp
is-Z0P7OFKVZU.tmp
is-AA15Z09EXB.tmp
is-DVX6JEH9HQ.tmp
is-3DDBCQOOUM.tmp
is-X7D5OVUU33.tmp
is-KX2N76V50H.tmp
cli.js
nls.messages.json
cliProcessMain.js
package.json
product.json
v8_context_snapshot.bin
__PSScriptPolicyTest_d3k5ove4.rlz.ps1
MyDevAgent-Studio-Setup.tmp
extensions.builtin.cache
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
package.json
memory/2124-4560-0x00000214D8B10000-0x00000214D8B1A000-memory.dmp
memory/2124-4564-0x00000214D8C80000-0x00000214D8C88000-memory.dmp
memory/2124-4558-0x00000214D8A30000-0x00000214D8A4C000-memory.dmp
memory/2124-4572-0x00000214BC960000-0x00000214BC970000-memory.dmp
memory/2124-4573-0x00000214BC960000-0x00000214BC970000-memory.dmp
memory/2124-4566-0x00000214D8CC0000-0x00000214D8CCA000-memory.dmp
memory/2124-4565-0x00000214D8CB0000-0x00000214D8CB6000-memory.dmp
memory/2124-4542-0x00000214BC960000-0x00000214BC970000-memory.dmp
memory/2124-4563-0x00000214D8CD0000-0x00000214D8CEA000-memory.dmp
memory/2124-4562-0x00000214D8C70000-0x00000214D8C7A000-memory.dmp
memory/2124-4561-0x00000214D8C90000-0x00000214D8CAC000-memory.dmp
memory/2124-4543-0x00000214BC960000-0x00000214BC970000-memory.dmp
memory/2124-4576-0x00000214BC960000-0x00000214BC970000-memory.dmp
memory/2124-4550-0x00000214D8680000-0x00000214D86A2000-memory.dmp
memory/2124-4559-0x00000214D8A50000-0x00000214D8B03000-memory.dmp
memory/2640-4697-0x0000000000C00000-0x000000000103D000-memory.dmp
memory/2640-4450-0x0000000000C00000-0x000000000103D000-memory.dmp
memory/2640-936-0x0000000000C00000-0x000000000103D000-memory.dmp
memory/2640-17-0x0000000000C00000-0x000000000103D000-memory.dmp
memory/2640-4575-0x0000000000C00000-0x000000000103D000-memory.dmp
memory/2640-18-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/2640-5-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/2640-4919-0x0000000000C00000-0x000000000103D000-memory.dmp
memory/4108-1-0x0000000000370000-0x0000000000453000-memory.dmp
memory/4108-16-0x0000000000370000-0x0000000000453000-memory.dmp