Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 16:22

General

  • Target
    setup.exe
  • Size 65.3MB
  • Sample260930-tvnsyscf97
  • SHA256 05412ace0817df3ff83e209158cd9ac914aa71fd11b34c4c2dae4b32966985ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 39 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\is-2S0PG.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2S0PG.tmp\setup.tmp" /SL5="$A01BC,67573884,832512,C:\Users\Admin\AppData\Local\Temp\setup.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Program Files\Asset Keeper Pro\akpro.exe
        "C:\Program Files\Asset Keeper Pro\akpro.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: GetForegroundWindowSpam
        PID:5068

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Appearance Pakx64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\Appearance Pakx64.dll
        • Size 242KB
        • SHA256 d381ce32bf1e44a8695a4af71077b2e6768720072b9633d102a60cece7519e80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Cryptox64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\Cryptox64.dll
        • Size 696KB
        • SHA256 594a18f4ee93f88b9ca915fae3b106f63c5a0abeb0c55bec9fce93a9efb3feca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EHObjectArray9021.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\EHObjectArray9021.dll
        • Size 30KB
        • SHA256 bd88b99a0f8ee7ce531571b4b1eca3b5af49e7114b2bf7d94e6ecaa418c78b39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EHObjectCollection9021.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\EHObjectCollection9021.dll
        • Size 40KB
        • SHA256 644620d7e498cfc5a3216d942f457acb242d51c2ebdcce3082ec418ea3c44b89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EHPictureButton8101.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\EHPictureButton8101.dll
        • Size 53KB
        • SHA256 d5725d701f036a9fd8010f619c9a17e7ec85cf66491351dbb658ac3d7362d531
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GUIKitx64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\GUIKitx64.dll
        • Size 78KB
        • SHA256 aeffa8d17971b9aa1af6dc7296ec777cbc0229bafc4bb90d7cc57cfce3d5eee5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GZipx64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\GZipx64.dll
        • Size 151KB
        • SHA256 0d72a0714737df489668420208ac68f4a9911e3a31a29027f0aac102ecc3074c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Internet Encodingsx64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\Internet Encodingsx64.dll
        • Size 30KB
        • SHA256 f5b51b0d37ca18ebfe4920174c47c9e83c2da084d59b78b01d676a3d292d3493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_Compression_Zip_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_Compression_Zip_Plugin_21346.dll
        • Size 231KB
        • SHA256 5834283e14914c2fa4ec9527fdaa6afac9bd350bde53eeb54d8c36cabfbef778
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_DynaPDF_dynapdf_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_DynaPDF_dynapdf_Plugin_21346.dll
        • Size 9.5MB
        • SHA256 4ccaa3f153fa8b6a34ddaddf9fc194e03dcc96aa1ba11bb7432d63e0c5266bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_MacOSX_MacOSX_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_MacOSX_MacOSX_Plugin_21346.dll
        • Size 86KB
        • SHA256 cc97e82d4aa9bfd3c8b5fc6d39a7cbfdf3835e4c68cc65363952f103a1dbf296
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_Main_Registration_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_Main_Registration_Plugin_21346.dll
        • Size 184KB
        • SHA256 1aad6754059562e93e205faac29da112886df1c7e71f36690f6864494b6b412a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_SQL_SQL_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_SQL_SQL_Plugin_21346.dll
        • Size 1.4MB
        • SHA256 5528e48f55a08e70e83598d97cdf6d0cd65ba1bae25af8efb769343899d972a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_Util_Files_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_Util_Files_Plugin_21346.dll
        • Size 200KB
        • SHA256 329f6300de0abb2e65ba5a9a18880778649d803e6a9b3c493a012bd564cc73fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_Util_SystemInformation_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_Util_SystemInformation_Plugin_21346.dll
        • Size 227KB
        • SHA256 60f69218cbacf01a9a1f947cde480b50a6e6a493d15398f75c152fbf57b90bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_Util_UUID_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_Util_UUID_Plugin_21346.dll
        • Size 83KB
        • SHA256 7f8ce09839b9201247a0e70b29dc6905ebbfebdda64cb6a74da12dec2aa28c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_Win_Win_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_Win_Win_Plugin_21346.dll
        • Size 271KB
        • SHA256 6dbe10f7c483af73b8e45031d4e6fa902677d9fd8952ab5bd2cb0d62f58db01d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MBS_XL_XL_Plugin_21346.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\MBS_XL_XL_Plugin_21346.dll
        • Size 8.7MB
        • SHA256 58222a57239a71fe3ff2e49924f9ae85067494a8c74bbbac17b84ee4576f8d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ODBCPluginx64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\ODBCPluginx64.dll
        • Size 287KB
        • SHA256 9cf4b21411445d9b9d8424ffba1e6ea4c2cbca27f85c8f31e5bbd16697044763
        • MD5 SHA1 SHA512 SSDEEP TLSH

        REALSQLDatabasex64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\REALSQLDatabasex64.dll
        • Size 1.0MB
        • SHA256 262fee34a3aa5abccf45d6969c60645075c463e773f4dcae6da3239b071716f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RegExx64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\RegExx64.dll
        • Size 379KB
        • SHA256 f12c0e4915276f5dfc5a30fd6a147e84299d2b8cffeaf198e4aadc6f6cd87ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SQLiteDatabasex64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\SQLiteDatabasex64.dll
        • Size 1.7MB
        • SHA256 30a5e5befd501489b1fc2726414955a117df3fd5841bb37224487f53417bddd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SSLSocketx64.dll

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Libs\SSLSocketx64.dll
        • Size 2.3MB
        • SHA256 5ad3b4222bd5cfae66d120a879ba59a9636602b12faa76e7a8318130d086daf4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-RKT2K.tmp

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Resources\is-RKT2K.tmp
        • Size 1KB
        • SHA256 a851bd685c9511ef44e09398c541e796522726fdf3766947236fec076e1a4283
        • MD5 SHA1 SHA512 TLSH

        tb_fm_print.png

        • Path C:\Program Files\Asset Keeper Pro\AKPRO Resources\tb_fm_print.png
        • Size 1KB
        • SHA256 c133b31a564af53b6e831db333a6107ce8bdb844e773b7dbbf71f2931f0f2c2f
        • MD5 SHA1 SHA512 TLSH

        XojoGUIFramework64.dll

        • Path C:\Program Files\Asset Keeper Pro\XojoGUIFramework64.dll
        • Size 4.1MB
        • SHA256 593e6458d9c0e976e27228473afa7a8944fc42d01e89c4771504718e643ef251
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Shellx64.dll

        • Path C:\Program Files\Asset Keeper Pro\akpro Libs\Shellx64.dll
        • Size 36KB
        • SHA256 2a08a23c8f07b9a452ffbc93504e6474b527d1846a25ff7c4004176f3b93a2c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Program Files\Asset Keeper Pro\msvcp140.dll
        • Size 561KB
        • SHA256 7b8a6f283884e6448559dcf510b00c1a885bfb8e598ea05cd2c290c874657326
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcr120.dll

        • Path C:\Program Files\Asset Keeper Pro\msvcr120.dll
        • Size 940KB
        • SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140.dll

        • Path C:\Program Files\Asset Keeper Pro\vcruntime140.dll
        • Size 117KB
        • SHA256 642ae52687a7a6bfb03d0b20dc7e07f4b11ceca634f7eb7ba184d6711ab51a51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_1.dll

        • Path C:\Program Files\Asset Keeper Pro\vcruntime140_1.dll
        • Size 48KB
        • SHA256 0e560532e721b6938dafe4055eedd0251ba5eb5994cd96937cebbcf16a7ddae5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        REGINFO.PW

        • Path C:\ProgramData\AKPRO\REGINFO.PW
        • Size 1024B
        • SHA256 ba17212f1a7826fb97ad4b58ab91122ebde634d61430207081f3a50a779dca77
        • MD5 SHA1 SHA512 TLSH

        setup.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-2S0PG.tmp\setup.tmp
        • Size 3.1MB
        • SHA256 cd543d79c6117e3def182124508a8b62ef946aa2e629757655b72a2172df142e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SampleDataFile.akp

        • Path C:\Users\Admin\Documents\AKPRO_Data\SAMPLEDATA\SampleDataFile.akp
        • Size 223KB
        • SHA256 9accdd7d3949cbdc4640eb3ca7039a2e1dea321bc7a443f3d0fc6fe89abdb93a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2424-7-0x0000000000400000-0x00000000004D8000-memory.dmp

        memory/2424-0-0x0000000000400000-0x00000000004D8000-memory.dmp

        memory/2424-1761-0x0000000000400000-0x00000000004D8000-memory.dmp

        memory/2836-8-0x0000000000400000-0x000000000071C000-memory.dmp

        memory/2836-5-0x0000000002820000-0x0000000002821000-memory.dmp

        memory/2836-1760-0x0000000000400000-0x000000000071C000-memory.dmp

        memory/2836-9-0x0000000002820000-0x0000000002821000-memory.dmp

        memory/2836-1678-0x0000000000400000-0x000000000071C000-memory.dmp

        memory/2836-11-0x0000000000400000-0x000000000071C000-memory.dmp

        memory/5068-1757-0x0000000004020000-0x0000000004040000-memory.dmp

        memory/5068-1752-0x0000000003FA0000-0x0000000003FAD000-memory.dmp

        memory/5068-1759-0x0000000004050000-0x000000000405B000-memory.dmp

        memory/5068-1756-0x0000000003FF0000-0x0000000004005000-memory.dmp

        memory/5068-1694-0x0000000140000000-0x0000000141000000-memory.dmp

        memory/5068-1755-0x0000000003FC0000-0x0000000003FD1000-memory.dmp

        memory/5068-1786-0x0000000003660000-0x0000000003F5A000-memory.dmp

        memory/5068-1747-0x0000000003F70000-0x0000000003F82000-memory.dmp