Analysis
- user interaction
yes - max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/09/2026, 19:05
General
- Target [FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe
- Size 3.8MB
- Sample260929-xrn64avanf
- SHA256 4c2bfaabf9eb7f8d106d2c0fc93d597cd4da709dcfe7bf9c372ff68a994758ed
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Drops file in System32 directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe"C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2N063.tmp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.tmp"C:\Users\Admin\AppData\Local\Temp\is-2N063.tmp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.tmp" /SL5="$40104,3540732,152064,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
[FreeTP.Org]Hello-Neighbor-Multiplayer-Fix-Online-v16.03.26.tmp
CheckBox.png
DirFolder.png
Edit.png
GroupFolder.png
HDD.png
HardDrivePanel.png
RequirementsPanel.png
StatusPanel.png
StatusPanel2.png
WizardImage.jpg
Workspace.png
botva2.dll
button.png
innocallback.dll
memory/3928-0-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3928-105-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3928-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4276-72-0x0000000007010000-0x0000000007025000-memory.dmp
memory/4276-119-0x0000000000400000-0x000000000057B000-memory.dmp
memory/4276-123-0x0000000000400000-0x000000000057B000-memory.dmp
memory/4276-126-0x0000000007190000-0x0000000007290000-memory.dmp
memory/4276-116-0x0000000006AE0000-0x0000000006AED000-memory.dmp
memory/4276-115-0x0000000000400000-0x000000000057B000-memory.dmp
memory/4276-117-0x0000000007010000-0x0000000007025000-memory.dmp
memory/4276-111-0x0000000000400000-0x000000000057B000-memory.dmp
memory/4276-107-0x0000000006AE0000-0x0000000006AED000-memory.dmp
memory/4276-109-0x0000000002350000-0x0000000002351000-memory.dmp
memory/4276-106-0x0000000000400000-0x000000000057B000-memory.dmp
memory/4276-108-0x0000000007010000-0x0000000007025000-memory.dmp
memory/4276-30-0x0000000006AE0000-0x0000000006AED000-memory.dmp
memory/4276-138-0x0000000000400000-0x000000000057B000-memory.dmp
memory/4276-6-0x0000000002350000-0x0000000002351000-memory.dmp