Overview

overview

7

Static

static

3

spotifast-...up.exe

windows10-2004-x64

7

spotifast-...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/10/2026, 23:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe
  • Size 11.3MB
  • Sample261007-3tk54sht9m
  • SHA256 859be093b02446ecdfc6c4c745eed153efd8fb52ead6663e8c6d1943b772effb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\is-BIQOMK3BKA.tmp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BIQOMK3BKA.tmp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp" /SL5="$80054,10599627,872960,C:\Users\Admin\AppData\Local\Temp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe
        "C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1172
  • C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe
    "C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4896
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1380
  • C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe
    "C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        spotifast.exe
        • Path C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe
        • Size 29.0MB
        • SHA256 e4867b8eb54021732126b6f0c906702b31d2ffc7a6e725e3dcb121b2f478fe01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-BIQOMK3BKA.tmp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp
        • Size 4.2MB
        • SHA256 e29432eded5dd93124630e0924d89198191bd6a42304aa77add667c17b1780ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spotifast.log
        • Path C:\Users\Admin\AppData\Local\paolino\spotifast\data\spotifast.log
        • Size 84B
        • SHA256 aa08d6f9fa226afe2a97ea7bcfd3ffc294382fff95bb362239fe528811a982a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        spotifast.log
        • Path C:\Users\Admin\AppData\Local\paolino\spotifast\data\spotifast.log
        • Size 84B
        • SHA256 a9ea83269919c8b174b3740b82c5c125b1a160f6a33064f5575c3151032c3220
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .installed-palettes
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\.installed-palettes
        • Size 135B
        • SHA256 648201537a89265f0a719f48ffa913ba952d8f23cba4b0ba2bc46e16cbb598f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Catppuccin Latte.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Catppuccin Latte.json
        • Size 414B
        • SHA256 b99bef4c810b4909f68428f8cc3ddde03dea80ac8dd8ad1a66f743529212e86e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Catppuccin.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Catppuccin.json
        • Size 413B
        • SHA256 f88a3b20f470a129001f34b5f3fdec1d7823de5ab75b9ca1503ce72643789d3d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nord.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Nord.json
        • Size 413B
        • SHA256 d4e2e8fce15442dd1533e7c5c0c47f7a363ec0d15d201b0bc127b4aef6bcbfeb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Ristretto.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Ristretto.json
        • Size 413B
        • SHA256 54a54190d0fe09cae6946a31efaa8a630993d747a5741ab6fdaccfcc85cf911c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Rose Pine Dawn.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Rose Pine Dawn.json
        • Size 414B
        • SHA256 6fa67ef765db32ca7617004fbb82d3a72954fc765275025d35948d55da866f43
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Rose Pine Moon.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Rose Pine Moon.json
        • Size 413B
        • SHA256 1023af76a3fc3e69a3b011ec249b31ff512f23cd4376b6a61337b049cd794913
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Rose Pine.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Rose Pine.json
        • Size 413B
        • SHA256 22a4ec4f1e0bd4acf252e21de2811f554e20ad02c1bc19fa4308bde59a0dc70e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Tokyo Night.json
        • Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Tokyo Night.json
        • Size 413B
        • SHA256 ac7f407a78c1b647d5515fa15d8d1a6670021b3eae48777122b2df2257b27f4c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/808-39-0x0000000000C70000-0x00000000010AE000-memory.dmp
        Download

        memory/808-9-0x0000000001580000-0x0000000001581000-memory.dmp
        Download

        memory/808-5-0x0000000001580000-0x0000000001581000-memory.dmp
        Download

        memory/808-8-0x0000000000C70000-0x00000000010AE000-memory.dmp
        Download

        memory/1380-110-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-98-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-100-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-99-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-109-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-108-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-107-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-106-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-105-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/1380-104-0x000001E232C00000-0x000001E232C01000-memory.dmp
        Download

        memory/2936-7-0x0000000000430000-0x0000000000514000-memory.dmp
        Download

        memory/2936-40-0x0000000000430000-0x0000000000514000-memory.dmp
        Download

        memory/2936-0-0x0000000000430000-0x0000000000514000-memory.dmp
        Download