Analysis
- max time kernel
300s - max time network
241s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 22:53
General
- Target Syn3Updater_Installer.exe
- Size 996KB
- Sample260928-2txngavgpg
- SHA256 5c550f313e5e3fa0c261df8420d1204a501ecf86c90937e7c64b558586805f44
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Control Panel 1 IoCs
- Modifies registry class 15 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Syn3Updater_Installer.exe"C:\Users\Admin\AppData\Local\Temp\Syn3Updater_Installer.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CyanLabs\Syn3Updater\Launcher.exe"C:\Program Files (x86)\CyanLabs\Syn3Updater\Launcher.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CyanLabs\Syn3Updater\Syn3Updater.exe"C:\Program Files (x86)\CyanLabs\Syn3Updater\Syn3Updater.exe" /launcher /updated3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Launcher.exe
Newtonsoft.Json.dll
Octokit.dll
Syn3Updater.exe
launcherPrefs.json
System.dll
modern-wizard.bmp
nsDialogs.dll
memory/5100-336-0x0000025C4CEE0000-0x0000025C4CEF2000-memory.dmp
memory/5100-342-0x0000025C4D9E0000-0x0000025C4D9EC000-memory.dmp
memory/5100-354-0x0000025C4DAA0000-0x0000025C4DAA8000-memory.dmp
memory/5100-353-0x0000025C4DA90000-0x0000025C4DAA0000-memory.dmp
memory/5100-352-0x0000025C4DA80000-0x0000025C4DA8A000-memory.dmp
memory/5100-351-0x0000025C4DB90000-0x0000025C4DBA8000-memory.dmp
memory/5100-350-0x0000025C4DDB0000-0x0000025C4DE84000-memory.dmp
memory/5100-349-0x0000025C4DA70000-0x0000025C4DA78000-memory.dmp
memory/5100-347-0x0000025C4DA40000-0x0000025C4DA48000-memory.dmp
memory/5100-346-0x0000025C4DA30000-0x0000025C4DA38000-memory.dmp
memory/5100-345-0x0000025C4DC10000-0x0000025C4DCC2000-memory.dmp
memory/5100-344-0x0000025C4DA20000-0x0000025C4DA2A000-memory.dmp
memory/5100-343-0x0000025C4DA10000-0x0000025C4DA1A000-memory.dmp
memory/5100-341-0x0000025C4DAB0000-0x0000025C4DB44000-memory.dmp
memory/5100-340-0x0000025C4D580000-0x0000025C4D63A000-memory.dmp
memory/5100-324-0x0000025C31B90000-0x0000025C31C32000-memory.dmp
memory/5100-335-0x0000025C4C2A0000-0x0000025C4C2AA000-memory.dmp
memory/5100-326-0x0000025C32190000-0x0000025C321CE000-memory.dmp
memory/5100-327-0x0000025C4CF20000-0x0000025C4D006000-memory.dmp
memory/5100-328-0x0000025C4C210000-0x0000025C4C236000-memory.dmp
memory/5100-329-0x0000025C33AC0000-0x0000025C33AC8000-memory.dmp
memory/5100-330-0x0000025C33AF0000-0x0000025C33AFA000-memory.dmp
memory/5100-331-0x0000025C33B20000-0x0000025C33B2A000-memory.dmp
memory/5100-332-0x0000025C4C2D0000-0x0000025C4C2EA000-memory.dmp
memory/5100-333-0x0000025C33B30000-0x0000025C33B38000-memory.dmp
memory/5100-334-0x0000025C4C290000-0x0000025C4C29A000-memory.dmp
memory/5520-44-0x00000173FFE70000-0x00000173FFF6A000-memory.dmp
memory/5520-33-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5520-30-0x00007FF99BCFF000-0x00007FF99BD00000-memory.dmp
memory/5520-32-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5520-321-0x00000173FF840000-0x00000173FF862000-memory.dmp
memory/5520-35-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5520-47-0x00000173FF7F0000-0x00000173FF802000-memory.dmp
memory/5520-45-0x00000173FF280000-0x00000173FF28A000-memory.dmp
memory/5520-31-0x00000173FEDC0000-0x00000173FEE1A000-memory.dmp
memory/5520-42-0x00000173FF920000-0x00000173FF9D0000-memory.dmp
memory/5520-325-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5520-41-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5520-34-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5520-38-0x00000173FF2A0000-0x00000173FF2DE000-memory.dmp
memory/5520-39-0x00000173FF270000-0x00000173FF27E000-memory.dmp
memory/5520-37-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp
memory/5520-36-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp