Analysis
- geolocation tags
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/09/2026, 16:18
General
- Target Process Lasso 18.3.0.34.exe
- Size 5.4MB
- Sample260925-tr5bjavyht
- SHA256 a17a72a527f3a3789d153de27232f3cbf25f6a923611d167e0f7ed757f93e1d5
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H1PHO.tmp\Process Lasso 18.3.0.34.tmp"C:\Users\Admin\AppData\Local\Temp\is-H1PHO.tmp\Process Lasso 18.3.0.34.tmp" /SL5="$602FE,5298690,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Process Lasso 18.3.0.34.tmp
ISTask.dll
VclStylesInno.dll
memory/1420-46-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-42-0x0000000007970000-0x0000000007971000-memory.dmp
memory/1420-22-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-35-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-37-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-83-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-86-0x000000000763E000-0x000000000763F000-memory.dmp
memory/1420-82-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-81-0x0000000007A40000-0x0000000007A41000-memory.dmp
memory/1420-79-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-78-0x0000000007A30000-0x0000000007A31000-memory.dmp
memory/1420-77-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-76-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-75-0x0000000007A20000-0x0000000007A21000-memory.dmp
memory/1420-73-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-72-0x0000000007A10000-0x0000000007A11000-memory.dmp
memory/1420-71-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-70-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-69-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/1420-67-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-66-0x00000000079F0000-0x00000000079F1000-memory.dmp
memory/1420-65-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-64-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-63-0x00000000079E0000-0x00000000079E1000-memory.dmp
memory/1420-62-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-59-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-58-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-43-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-54-0x00000000079B0000-0x00000000079B1000-memory.dmp
memory/1420-53-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-52-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-51-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/1420-49-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-48-0x0000000007990000-0x0000000007991000-memory.dmp
memory/1420-47-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-5-0x0000000002290000-0x0000000002291000-memory.dmp
memory/1420-16-0x0000000007270000-0x0000000007286000-memory.dmp
memory/1420-45-0x0000000007980000-0x0000000007981000-memory.dmp
memory/1420-55-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-41-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-40-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-39-0x0000000007960000-0x0000000007961000-memory.dmp
memory/1420-38-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-36-0x0000000007950000-0x0000000007951000-memory.dmp
memory/1420-80-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-74-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-68-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-61-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-60-0x00000000079D0000-0x00000000079D1000-memory.dmp
memory/1420-57-0x00000000079C0000-0x00000000079C1000-memory.dmp
memory/1420-56-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-33-0x0000000007940000-0x0000000007941000-memory.dmp
memory/1420-50-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-32-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-31-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-30-0x0000000007930000-0x0000000007931000-memory.dmp
memory/1420-29-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-28-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-27-0x0000000007920000-0x0000000007921000-memory.dmp
memory/1420-44-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-24-0x0000000007910000-0x0000000007911000-memory.dmp
memory/1420-34-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-26-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-25-0x00000000077C0000-0x0000000007900000-memory.dmp
memory/1420-87-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-88-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-89-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-90-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-91-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-92-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-95-0x0000000002290000-0x0000000002291000-memory.dmp
memory/1420-100-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/1420-101-0x00000000074A0000-0x00000000077BA000-memory.dmp
memory/5048-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5048-96-0x0000000000400000-0x0000000000416000-memory.dmp