Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
29/09/2026, 19:05
General
- Target [FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe
- Size 3.8MB
- Sample260929-xrn64avanf
- SHA256 4c2bfaabf9eb7f8d106d2c0fc93d597cd4da709dcfe7bf9c372ff68a994758ed
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe"C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VG49K.tmp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.tmp"C:\Users\Admin\AppData\Local\Temp\is-VG49K.tmp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.tmp" /SL5="$70158,3540732,152064,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CheckBox.png
WizardImage.jpg
botva2.dll
button.png
innocallback.dll
[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.tmp
memory/3248-113-0x0000000004EE0000-0x0000000004FE0000-memory.dmp
memory/3248-117-0x0000000003A80000-0x0000000003A95000-memory.dmp
memory/3248-29-0x0000000003450000-0x000000000345D000-memory.dmp
memory/3248-5-0x0000000002470000-0x0000000002471000-memory.dmp
memory/3248-122-0x0000000003A80000-0x0000000003A95000-memory.dmp
memory/3248-108-0x0000000002470000-0x0000000002471000-memory.dmp
memory/3248-107-0x0000000003A80000-0x0000000003A95000-memory.dmp
memory/3248-106-0x0000000003450000-0x000000000345D000-memory.dmp
memory/3248-105-0x0000000000400000-0x000000000057B000-memory.dmp
memory/3248-118-0x0000000004EE0000-0x0000000004FE0000-memory.dmp
memory/3248-71-0x0000000003A80000-0x0000000003A95000-memory.dmp
memory/3248-116-0x0000000003450000-0x000000000345D000-memory.dmp
memory/3248-115-0x0000000000400000-0x000000000057B000-memory.dmp
memory/4124-0-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4124-104-0x0000000000400000-0x000000000042F000-memory.dmp