Analysis
- geolocation tags
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/09/2026, 16:18
General
- Target _Unpack Portable.cmd
- Size 1KB
- Sample260925-tr5bjavyht
- SHA256 7256488f34caa5538294556b0b728e291cbe635f8d3cc6cd8195ad4bef1f782d
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Unpack Portable.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe"Process Lasso 18.3.0.34.exe" /SILENT /PORTABLE=12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NH9JE.tmp\Process Lasso 18.3.0.34.tmp"C:\Users\Admin\AppData\Local\Temp\is-NH9JE.tmp\Process Lasso 18.3.0.34.tmp" /SL5="$702B6,5298690,60928,C:\Users\Admin\AppData\Local\Temp\Process Lasso 18.3.0.34.exe" /SILENT /PORTABLE=13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ISTask.dll
VclStylesInno.dll
Process Lasso 18.3.0.34.tmp
memory/2780-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5052-5-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/5052-16-0x00000000023F0000-0x0000000002406000-memory.dmp
memory/5052-22-0x00000000074D0000-0x00000000077EA000-memory.dmp
memory/5052-32-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-41-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-47-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-46-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-45-0x0000000007970000-0x0000000007971000-memory.dmp
memory/5052-44-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-43-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-42-0x0000000007960000-0x0000000007961000-memory.dmp
memory/5052-40-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-39-0x0000000007950000-0x0000000007951000-memory.dmp
memory/5052-38-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-37-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-36-0x0000000007940000-0x0000000007941000-memory.dmp
memory/5052-35-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-34-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-33-0x0000000007930000-0x0000000007931000-memory.dmp
memory/5052-31-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-30-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5052-29-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-28-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-27-0x0000000002430000-0x0000000002431000-memory.dmp
memory/5052-26-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-25-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-24-0x0000000002420000-0x0000000002421000-memory.dmp
memory/5052-50-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-53-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-70-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-83-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-86-0x000000000766E000-0x000000000766F000-memory.dmp
memory/5052-82-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-81-0x0000000007A30000-0x0000000007A31000-memory.dmp
memory/5052-80-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-78-0x0000000007A20000-0x0000000007A21000-memory.dmp
memory/5052-77-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-76-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-75-0x0000000007A10000-0x0000000007A11000-memory.dmp
memory/5052-74-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-73-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-72-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/5052-71-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-69-0x00000000079F0000-0x00000000079F1000-memory.dmp
memory/5052-68-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-67-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-66-0x00000000079E0000-0x00000000079E1000-memory.dmp
memory/5052-64-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-63-0x00000000079D0000-0x00000000079D1000-memory.dmp
memory/5052-62-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-61-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-79-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-60-0x00000000079C0000-0x00000000079C1000-memory.dmp
memory/5052-59-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-58-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-57-0x00000000079B0000-0x00000000079B1000-memory.dmp
memory/5052-56-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-55-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-54-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/5052-65-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-52-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-51-0x0000000007990000-0x0000000007991000-memory.dmp
memory/5052-49-0x00000000077F0000-0x0000000007930000-memory.dmp
memory/5052-48-0x0000000007980000-0x0000000007981000-memory.dmp
memory/5052-87-0x00000000074D0000-0x00000000077EA000-memory.dmp
memory/5052-88-0x00000000074D0000-0x00000000077EA000-memory.dmp
memory/5052-89-0x00000000074D0000-0x00000000077EA000-memory.dmp
memory/5052-90-0x00000000074D0000-0x00000000077EA000-memory.dmp
memory/5052-92-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/5052-91-0x00000000074D0000-0x00000000077EA000-memory.dmp
memory/5052-203-0x00000000074D0000-0x00000000077EA000-memory.dmp
memory/5052-260-0x0000000000400000-0x00000000004F6000-memory.dmp