Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
30/09/2026, 02:15
General
- Target DeskRest_n.exe
- Size 5.9MB
- Sample260930-cpp1dsvt6j
- SHA256 51312177a9c81ae610e7b73a8d3330c54c130baf901516351d250357d0c3ff6d
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 41 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DeskRest_n.exe"C:\Users\Admin\AppData\Local\Temp\DeskRest_n.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A2D25.tmp\DeskRest_n.tmp"C:\Users\Admin\AppData\Local\Temp\is-A2D25.tmp\DeskRest_n.tmp" /SL5="$80044,5342404,889856,C:\Users\Admin\AppData\Local\Temp\DeskRest_n.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\DeskRest\DeskRest.exe"C:\Users\Admin\AppData\Local\Programs\DeskRest\DeskRest.exe"3⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Programs\DeskRest\DeskRest.exeC:\Users\Admin\AppData\Local\Programs\DeskRest\DeskRest.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_36EE663D4B62837EEC0FFC3E020A5213
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
8EC9B1D0ABBD7F98B401D425828828CE_36EE663D4B62837EEC0FFC3E020A5213
C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
bgy4h4pv.newcfg
user.config
xrvfzt2c.newcfg
identity.dat
info.dat
Countly.dll
DeskRest.exe
DeskRest.exe.config
Hardcodet.NotifyIcon.Wpf.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.Wpf.dll
Newtonsoft.Json.dll
Sentry.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
System.Threading.Tasks.Extensions.dll
WebView2Loader.dll
.installation
DeskRest_n.tmp
hgsdk.dll
memory/848-82-0x0000000000400000-0x000000000071A000-memory.dmp
memory/848-71-0x0000000000400000-0x000000000071A000-memory.dmp
memory/848-19-0x0000000000400000-0x000000000071A000-memory.dmp
memory/848-17-0x0000000000400000-0x000000000071A000-memory.dmp
memory/848-14-0x0000000000400000-0x000000000071A000-memory.dmp
memory/848-15-0x0000000002490000-0x0000000002491000-memory.dmp
memory/848-5-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3672-142-0x0000000006CB0000-0x0000000006D16000-memory.dmp
memory/3672-193-0x00000000086C0000-0x00000000086CE000-memory.dmp
memory/3672-121-0x0000000006420000-0x000000000642A000-memory.dmp
memory/3672-146-0x00000000075E0000-0x0000000007937000-memory.dmp
memory/3672-117-0x0000000006410000-0x000000000641A000-memory.dmp
memory/3672-144-0x0000000007B00000-0x00000000080A6000-memory.dmp
memory/3672-104-0x00000000063C0000-0x00000000063E6000-memory.dmp
memory/3672-143-0x00000000073B0000-0x0000000007442000-memory.dmp
memory/3672-136-0x0000000006BF0000-0x0000000006CA2000-memory.dmp
memory/3672-250-0x0000000005590000-0x00000000055A0000-memory.dmp
memory/3672-132-0x00000000068F0000-0x000000000692C000-memory.dmp
memory/3672-131-0x0000000006890000-0x00000000068A2000-memory.dmp
memory/3672-157-0x0000000008290000-0x000000000832E000-memory.dmp
memory/3672-178-0x0000000008250000-0x0000000008272000-memory.dmp
memory/3672-127-0x00000000066A0000-0x00000000066D0000-memory.dmp
memory/3672-145-0x00000000075B0000-0x00000000075D2000-memory.dmp
memory/3672-192-0x00000000086F0000-0x0000000008728000-memory.dmp
memory/3672-194-0x0000000008730000-0x000000000874C000-memory.dmp
memory/3672-188-0x0000000008240000-0x0000000008248000-memory.dmp
memory/3672-198-0x0000000008770000-0x0000000008788000-memory.dmp
memory/3672-113-0x00000000063F0000-0x0000000006406000-memory.dmp
memory/3672-108-0x0000000005EE0000-0x0000000005EE8000-memory.dmp
memory/3672-100-0x0000000005DD0000-0x0000000005DD8000-memory.dmp
memory/3672-99-0x0000000005DC0000-0x0000000005DC8000-memory.dmp
memory/3672-98-0x0000000005E40000-0x0000000005EC2000-memory.dmp
memory/3672-76-0x00000000008E0000-0x0000000000998000-memory.dmp
memory/3672-81-0x00000000056B0000-0x0000000005762000-memory.dmp
memory/3672-77-0x0000000005590000-0x00000000055A0000-memory.dmp
memory/4020-83-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/4020-13-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/4020-1-0x0000000000400000-0x00000000004E7000-memory.dmp