Overview

overview

7

Static

static

3

installer.exe

windows10-2004-x64

7

installer.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    56s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 05:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    installer.exe
  • Size 95.8MB
  • Sample260930-gmbr7sysa1
  • SHA256 45c9d512e30fcbc0d616c1e11a006758c5f8c5f88bfc0d500976243a4e00f737
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerspywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Users\Admin\AppData\Local\Temp\is-NS62QUEIZ2.tmp\installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NS62QUEIZ2.tmp\installer.tmp" /SL5="$901F0,99204211,893952,C:\Users\Admin\AppData\Local\Temp\installer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Program Files\OLL\OLL.exe
        "C:\Program Files\OLL\OLL.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Program Files\OLL\OLL.exe
          "C:\Program Files\OLL\OLL.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\OLL" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1728,i,15961326572942097838,14546343122247172451,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1724 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          PID:3764
        • C:\Program Files\OLL\OLL.exe
          "C:\Program Files\OLL\OLL.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\OLL" --field-trial-handle=1728,i,15961326572942097838,14546343122247172451,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2224 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:1772
        • C:\Program Files\OLL\OLL.exe
          "C:\Program Files\OLL\OLL.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\OLL" --app-user-model-id=com.OLL.app --app-path="C:\Program Files\OLL\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1728,i,15961326572942097838,14546343122247172451,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2472 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak
        • Path C:\Program Files\OLL\chrome_100_percent.pak
        • Size 112KB
        • SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Program Files\OLL\chrome_200_percent.pak
        • Size 182KB
        • SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Program Files\OLL\d3dcompiler_47.dll
        • Size 4.5MB
        • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxcompiler.dll
        • Path C:\Program Files\OLL\dxcompiler.dll
        • Size 24.4MB
        • SHA256 c9fad88ebb750723e6bd13d2d2eee6706ac97d4edced1f3e3e070d7c0c3b3e4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxil.dll
        • Path C:\Program Files\OLL\dxil.dll
        • Size 1.4MB
        • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Program Files\OLL\ffmpeg.dll
        • Size 2.9MB
        • SHA256 5957ae05e9811e24fb31bb6a57bd19935815ef4a831dcfdbfb0946fc0116a8ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Program Files\OLL\icudtl.dat
        • Size 10.3MB
        • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Program Files\OLL\libEGL.dll
        • Size 495KB
        • SHA256 b7583fd3f419c367ef2165e42fcf868baa4ed2cdf3aaaa3aeb4064e0eaa54842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libglesv2.dll
        • Path C:\Program Files\OLL\libglesv2.dll
        • Size 7.6MB
        • SHA256 c56fbb84f73b7630f8ab8831056d660a46b945e495378efec078153b446b6b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Program Files\OLL\locales\en-US.pak
        • Size 537KB
        • SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Program Files\OLL\resources.pak
        • Size 6.1MB
        • SHA256 7b9eb8ad65c34cecc64e06a6c2ac6afdfd750c044c71d9cf787d46abca777902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.asar
        • Path C:\Program Files\OLL\resources\app.asar
        • Size 10.2MB
        • SHA256 5675bff869c65c2aaef5f4be9efaecedae114da2fbd454d3c7e1160c66e948d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icon.ico
        • Path C:\Program Files\OLL\resources\assets\images\icon.ico
        • Size 9KB
        • SHA256 3de9a4a9933428c2dbdf245b98b861ca785fe6a6a17542bb96c40d7474c1ef68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Program Files\OLL\v8_context_snapshot.bin
        • Size 696KB
        • SHA256 62b96b879cdc221fd6527d71a5b73e02a138f971ac0c2ab1ff50953e4d34d74e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Program Files\OLL\vk_swiftshader.dll
        • Size 5.4MB
        • SHA256 6562324157ed32977e9f0f2227be04a2a8fb19a4946fee21e09a164ddc48310d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installer.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-NS62QUEIZ2.tmp\installer.tmp
        • Size 4.2MB
        • SHA256 97f6619b7b0926623498626720465c35395c7182d498f0fb6ea6468cf69790d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default.dic
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        memory/1504-11-0x0000000000A10000-0x0000000000E5B000-memory.dmp
        Download

        memory/1504-8-0x0000000000A10000-0x0000000000E5B000-memory.dmp
        Download

        memory/1504-38-0x0000000000A10000-0x0000000000E5B000-memory.dmp
        Download

        memory/1504-9-0x00000000009D0000-0x00000000009D1000-memory.dmp
        Download

        memory/1504-182-0x0000000000A10000-0x0000000000E5B000-memory.dmp
        Download

        memory/1504-5-0x00000000009D0000-0x00000000009D1000-memory.dmp
        Download

        memory/1504-185-0x0000000000A10000-0x0000000000E5B000-memory.dmp
        Download

        memory/4628-0-0x0000000000EF0000-0x0000000000FD9000-memory.dmp
        Download

        memory/4628-186-0x0000000000EF0000-0x0000000000FD9000-memory.dmp
        Download

        memory/4628-7-0x0000000000EF0000-0x0000000000FD9000-memory.dmp
        Download