Overview

overview

7

Static

static

3

CreamInstaller.exe

windows10-2004-x64

7

CreamInstaller.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    62s
  • max time network
    77s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 22:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CreamInstaller.exe
  • Size 159.4MB
  • Sample260928-131wtavcrd
  • SHA256 ff855dcc4560cd584fbdee1d30aeeb3a9db5141586814fc9a784da9dab177e5e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 42 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CreamInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\CreamInstaller.exe"
    1⤵
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\Microsoft.Win32.Registry.dll
        • Size 117KB
        • SHA256 a8cc5503bbba36472d1dd3a8eebc3a8b26f0b2882e770851aab486690b23ead9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.SystemEvents.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\Microsoft.Win32.SystemEvents.dll
        • Size 93KB
        • SHA256 ee167eb734016fb3b29360eeef2a022b0684411e53367dd85c7d67b0263c5208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Collections.Concurrent.dll
        • Size 269KB
        • SHA256 ed653ccb5dc40d0bb4ea3429165a0825705f2935a65c584ca67cba45671884c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Collections.NonGeneric.dll
        • Size 101KB
        • SHA256 b40cdf234652b31b443164350f73e25f98c5edecfd30698789d6dbf9ca456e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Specialized.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Collections.Specialized.dll
        • Size 101KB
        • SHA256 24022887037bfaad8c89c26642712c920dcc0ababd3396d80d8b2be16637673b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Collections.dll
        • Size 253KB
        • SHA256 c6bb79b8fb32504b6327b516e6ff32017a073669ab749d3c86ed49cd5f2f0c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.EventBasedAsync.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.ComponentModel.EventBasedAsync.dll
        • Size 45KB
        • SHA256 ce813a7cde09eba1bdd7d6661fa39c09057beddc78f554c5476c43766d763ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 d981af410d4ed7939fdee47a1ee58e3db472c05f17c2b0d48e4b1ebfb2fea0e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.TypeConverter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.ComponentModel.TypeConverter.dll
        • Size 729KB
        • SHA256 db04940603c749719e133bb567d142d46af3a6f2f37597db398955a3896b84c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.ComponentModel.dll
        • Size 29KB
        • SHA256 4d9e2e21ed5c16c100221433d1aab01409ec199c9f617e48b9fe1617989bbaa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Data.Common.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Data.Common.dll
        • Size 2.7MB
        • SHA256 089a74a39dceb113bea92522b227e24c881a618c5eb1e2abb166a6e8c12be0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.DiagnosticSource.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Diagnostics.DiagnosticSource.dll
        • Size 405KB
        • SHA256 25c3bf229337a485ceacb82c00f47f2e98de68a279eb5a450550526f9cbf0448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Diagnostics.Process.dll
        • Size 329KB
        • SHA256 7083c7046ac4cbed1068b6ae7a777d421eeaf180e5697283fc1c6af731c32a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.TraceSource.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Diagnostics.TraceSource.dll
        • Size 141KB
        • SHA256 2b5489bc5a6d65e109dbed6557dc2af3ba9dfb549efd18a64f37fd64255cb756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Common.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Drawing.Common.dll
        • Size 1.5MB
        • SHA256 dd17bff899c655e78ced0bfcfbd4c48d3545dfeb90dc9fb6fe07d315dd0bc2ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Drawing.Primitives.dll
        • Size 129KB
        • SHA256 02bd1f5644dd73789b82c3a52c8f86ef726baa1d4cce2a0c64d9dc1c29b9cb02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.Expressions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Linq.Expressions.dll
        • Size 3.5MB
        • SHA256 0f99977beddc9272d56a2e16b2581cde37f2afd43e77c8209827197c098dedeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Linq.dll
        • Size 529KB
        • SHA256 2b375e90fc687967bd95a0f47dbcba44d396923f3c98b7fe5754e34c8e4befaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Memory.dll
        • Size 153KB
        • SHA256 84242cce5eacc6963a77163986066bd0a1c2eb698b5f26dbdd5e6706e002fbc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Net.Http.dll
        • Size 1.7MB
        • SHA256 5102639c2037d77949340d94761c9a4c5053b940b8ae4ba2fbbe3507b8a5ec43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.NameResolution.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Net.NameResolution.dll
        • Size 109KB
        • SHA256 e8cc6c2f0d59fb018fdc4a66057e3a56a3aa5ed82fede17b2398cda88da407cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Net.Primitives.dll
        • Size 225KB
        • SHA256 0f929e8581f09fe85275df7b38549bc51415cd110aadfd89eade53943174511a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Net.Security.dll
        • Size 653KB
        • SHA256 c957641be9192e7812f209e2120e56a71da0d99b1a8443ca5f7947f38ea4376d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Sockets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Net.Sockets.dll
        • Size 533KB
        • SHA256 49e95c5a59172d80941992016eb35c965d8fb4bc05b745f85e793b6c010bdc6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.ObjectModel.dll
        • Size 77KB
        • SHA256 35187a8d7f9dc8896894d1a0a496fbabcd567f2ac0f047632f7178c308ff72f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Private.CoreLib.dll
        • Size 12.6MB
        • SHA256 99b168b84597a4f31fda8281efce7d42a14e2df0f4694194735e049dbc0f6418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Private.Uri.dll
        • Size 253KB
        • SHA256 f2a695dcd4073eaba43b4ee26f006c0174bff42673e17b38914450ca7d2547f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Private.Xml.dll
        • Size 7.6MB
        • SHA256 f7285c6a22e221784f1d81f884283e9dcd02aa7bfd17c428943d29e00170d749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Resources.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Resources.Extensions.dll
        • Size 133KB
        • SHA256 687ba24e8507233c542b9ce97b27495aa5d360889eb2bae9c4fc25f5942ba0d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Runtime.InteropServices.dll
        • Size 93KB
        • SHA256 1930aea4d91654a4daf13bf95b2daff023d3104a9b3794059ea139e550bcfb5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Numerics.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Runtime.Numerics.dll
        • Size 321KB
        • SHA256 d845c2a3d8edc282d5c32fd8020c2233fbeed3eb02b5064ab8637506049cfb70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Serialization.Formatters.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Runtime.Serialization.Formatters.dll
        • Size 301KB
        • SHA256 10c352dba07e5de49fe362edd9d8a44cfc60cd0136a48eb1a5104da30d2333e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Serialization.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Runtime.Serialization.Primitives.dll
        • Size 37KB
        • SHA256 65b4fdca2b36d551fa88c1cb8d7646ef9f29097b96487ab08fcf31f5dc9afe86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Claims.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Security.Claims.dll
        • Size 97KB
        • SHA256 45171f0ad174047cbf511e7761d7abb2d44988e899f690c36ff3c5bcfbcb2467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Security.Cryptography.dll
        • Size 2.0MB
        • SHA256 1e4c4ce04a46e2a2da8221bf583ebd4f6b5149d4b32792cacc5c33978d0bb121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Principal.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Security.Principal.Windows.dll
        • Size 181KB
        • SHA256 aace487981f8c9077620abf9c9d236ce5ef98241cf4222fbb49c717286f2cd0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Channels.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Threading.Channels.dll
        • Size 129KB
        • SHA256 ab05f710069580165c588789e0623e84d213c35594e3e12ae762a6c8265740b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Threading.dll
        • Size 81KB
        • SHA256 435c110b598d30f118d0e673068b535b693c5a77fae17398ad46821ce1261aba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Windows.Forms.Primitives.dll
        • Size 2.9MB
        • SHA256 e73d093d04473648a70ce7a072b56cd2a2c084364d173773bbb4d8d401851fd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\CreamInstaller\zqu7nK4s_g2EozemCotN_LZuj8XoAUg=\System.Windows.Forms.dll
        • Size 12.9MB
        • SHA256 2f06c91958c240fb4ed07265dd886d259457642cc151e9620ddb4641fdbc404f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download