Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 17:43
General
- Target [FreeTP.Org]Slap-The-Fly-Multiplayer-Fix-Online.exe
- Size 1.1MB
- Sample261003-warp8aee56
- SHA256 ed18f5dac32e0bf28bea22e408ac7ffb67e5ccadd014254c21b38999068a0eba
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 5 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Slap-The-Fly-Multiplayer-Fix-Online.exe"C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Slap-The-Fly-Multiplayer-Fix-Online.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SMPRB.tmp\[FreeTP.Org]Slap-The-Fly-Multiplayer-Fix-Online.tmp"C:\Users\Admin\AppData\Local\Temp\is-SMPRB.tmp\[FreeTP.Org]Slap-The-Fly-Multiplayer-Fix-Online.tmp" /SL5="$40176,602447,190464,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Slap-The-Fly-Multiplayer-Fix-Online.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CheckBox.png
DirFolder.png
Edit.png
GroupFolder.png
HDD.png
HardDrivePanel.png
RequirementsPanel.png
StatusPanel.png
StatusPanel2.png
WizardImage.jpg
Workspace.png
botva2.dll
button.png
get_hw_caps.dll
innocallback.dll
[FreeTP.Org]Slap-The-Fly-Multiplayer-Fix-Online.tmp
memory/1920-106-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-143-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-9-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-8-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-171-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-98-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-81-0x000000000B2B0000-0x000000000B2C5000-memory.dmp
memory/1920-167-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-163-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-120-0x000000000B2B0000-0x000000000B2C5000-memory.dmp
memory/1920-118-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-119-0x0000000007F30000-0x0000000007F3D000-memory.dmp
memory/1920-121-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-129-0x000000000B2B0000-0x000000000B2C5000-memory.dmp
memory/1920-128-0x0000000007F30000-0x0000000007F3D000-memory.dmp
memory/1920-127-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-131-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-135-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-139-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-38-0x0000000007F30000-0x0000000007F3D000-memory.dmp
memory/1920-147-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-151-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-155-0x0000000000400000-0x0000000000585000-memory.dmp
memory/1920-159-0x0000000000400000-0x0000000000585000-memory.dmp
memory/3136-117-0x0000000000400000-0x0000000000439000-memory.dmp
memory/3136-2-0x000000000041E000-0x000000000041F000-memory.dmp
memory/3136-0-0x0000000000400000-0x0000000000439000-memory.dmp