Overview

overview

7

Static

static

3

installer.exe

windows10-2004-x64

7

installer.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    87s
  • max time network
    69s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 05:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    installer.exe
  • Size 95.8MB
  • Sample260930-gmbr7sysa1
  • SHA256 45c9d512e30fcbc0d616c1e11a006758c5f8c5f88bfc0d500976243a4e00f737
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\AppData\Local\Temp\is-EP6K8X48CA.tmp\installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EP6K8X48CA.tmp\installer.tmp" /SL5="$80214,99204211,893952,C:\Users\Admin\AppData\Local\Temp\installer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Program Files\OLL\OLL.exe
        "C:\Program Files\OLL\OLL.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Program Files\OLL\OLL.exe
          "C:\Program Files\OLL\OLL.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\OLL" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1824,i,8708622402353063236,7410840486024403768,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1804 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          PID:4512
        • C:\Program Files\OLL\OLL.exe
          "C:\Program Files\OLL\OLL.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\OLL" --field-trial-handle=1824,i,8708622402353063236,7410840486024403768,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2220 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:1260
        • C:\Program Files\OLL\OLL.exe
          "C:\Program Files\OLL\OLL.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\OLL" --app-user-model-id=com.OLL.app --app-path="C:\Program Files\OLL\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1790747195799176 --launch-time-ticks=626810728 --field-trial-handle=1824,i,8708622402353063236,7410840486024403768,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2580 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2964
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1924

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          D3DCompiler_47.dll
          • Path C:\Program Files\OLL\D3DCompiler_47.dll
          • Size 4.5MB
          • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_100_percent.pak
          • Path C:\Program Files\OLL\chrome_100_percent.pak
          • Size 112KB
          • SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Program Files\OLL\chrome_200_percent.pak
          • Size 182KB
          • SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dxcompiler.dll
          • Path C:\Program Files\OLL\dxcompiler.dll
          • Size 24.4MB
          • SHA256 c9fad88ebb750723e6bd13d2d2eee6706ac97d4edced1f3e3e070d7c0c3b3e4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dxil.dll
          • Path C:\Program Files\OLL\dxil.dll
          • Size 1.4MB
          • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ffmpeg.dll
          • Path C:\Program Files\OLL\ffmpeg.dll
          • Size 2.9MB
          • SHA256 5957ae05e9811e24fb31bb6a57bd19935815ef4a831dcfdbfb0946fc0116a8ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Program Files\OLL\icudtl.dat
          • Size 10.3MB
          • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libegl.dll
          • Path C:\Program Files\OLL\libegl.dll
          • Size 495KB
          • SHA256 b7583fd3f419c367ef2165e42fcf868baa4ed2cdf3aaaa3aeb4064e0eaa54842
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libglesv2.dll
          • Path C:\Program Files\OLL\libglesv2.dll
          • Size 7.6MB
          • SHA256 c56fbb84f73b7630f8ab8831056d660a46b945e495378efec078153b446b6b8c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Program Files\OLL\locales\en-US.pak
          • Size 537KB
          • SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Program Files\OLL\resources.pak
          • Size 6.1MB
          • SHA256 7b9eb8ad65c34cecc64e06a6c2ac6afdfd750c044c71d9cf787d46abca777902
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.asar
          • Path C:\Program Files\OLL\resources\app.asar
          • Size 10.2MB
          • SHA256 5675bff869c65c2aaef5f4be9efaecedae114da2fbd454d3c7e1160c66e948d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icon.ico
          • Path C:\Program Files\OLL\resources\assets\images\icon.ico
          • Size 9KB
          • SHA256 3de9a4a9933428c2dbdf245b98b861ca785fe6a6a17542bb96c40d7474c1ef68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          v8_context_snapshot.bin
          • Path C:\Program Files\OLL\v8_context_snapshot.bin
          • Size 696KB
          • SHA256 62b96b879cdc221fd6527d71a5b73e02a138f971ac0c2ab1ff50953e4d34d74e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader.dll
          • Path C:\Program Files\OLL\vk_swiftshader.dll
          • Size 5.4MB
          • SHA256 6562324157ed32977e9f0f2227be04a2a8fb19a4946fee21e09a164ddc48310d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-EP6K8X48CA.tmp\installer.tmp
          • Size 4.2MB
          • SHA256 97f6619b7b0926623498626720465c35395c7182d498f0fb6ea6468cf69790d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          default.exc
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          memory/1752-192-0x0000000000EC0000-0x0000000000FA9000-memory.dmp
          Download

          memory/1752-0-0x0000000000EC0000-0x0000000000FA9000-memory.dmp
          Download

          memory/1752-8-0x0000000000EC0000-0x0000000000FA9000-memory.dmp
          Download

          memory/4812-191-0x0000000000090000-0x00000000004DB000-memory.dmp
          Download

          memory/4812-180-0x0000000000090000-0x00000000004DB000-memory.dmp
          Download

          memory/4812-39-0x0000000000090000-0x00000000004DB000-memory.dmp
          Download

          memory/4812-12-0x0000000000090000-0x00000000004DB000-memory.dmp
          Download

          memory/4812-9-0x0000000000090000-0x00000000004DB000-memory.dmp
          Download

          memory/4812-10-0x0000000000F20000-0x0000000000F21000-memory.dmp
          Download

          memory/4812-6-0x0000000000F20000-0x0000000000F21000-memory.dmp
          Download