Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 10:00
General
- Target 5a92502f1f9fa854af166d274f7134dd5d2f7cc9053bfc1df93990f94e89c4ad.exe
- Size 1.9MB
- Sample261014-l1435abs91
- SHA256 5a92502f1f9fa854af166d274f7134dd5d2f7cc9053bfc1df93990f94e89c4ad
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 7 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a92502f1f9fa854af166d274f7134dd5d2f7cc9053bfc1df93990f94e89c4ad.exe"C:\Users\Admin\AppData\Local\Temp\5a92502f1f9fa854af166d274f7134dd5d2f7cc9053bfc1df93990f94e89c4ad.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\TP- Project Data for 09 Sept 2026.xlsx"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bswwbbdi.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\bswwbbdi.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3JORMDKHCK.tmp\bswwbbdi.tmp"C:\Users\Admin\AppData\Local\Temp\is-3JORMDKHCK.tmp\bswwbbdi.tmp" /SL5="$E0222,945788,842240,C:\Users\Admin\AppData\Local\Temp\RarSFX0\bswwbbdi.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\TarnhowComputingLtd\TypeSetComposerKit\10.92.1344.2026101411024232\bin1\procsvc.exe"C:\Users\Admin\AppData\Local\TarnhowComputingLtd\TypeSetComposerKit\10.92.1344.2026101411024232\bin1\procsvc.exe" -Embedding4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\TarnhowComputingLtd\TypeSetComposerKit\10.92.1344.2026101411024232\bin2\updmon.exe"C:\Users\Admin\AppData\Local\TarnhowComputingLtd\TypeSetComposerKit\10.92.1344.2026101411024232\bin2\updmon.exe" -Embedding4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe C:\ProgramData\FAE6D6BA\D3D4CBC3.vbs1⤵
- Executes a VBScript file via the Windows Script Host.
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GameuxInstallHelper.dll
procsvc.exe
GameuxInstallHelper.dll
updmon.exe
TP- Project Data for 09 Sept 2026.xlsx
bswwbbdi.exe
bswwbbdi.tmp
0AOHC0B6ITMADNPS2I7U.temp
memory/1060-16-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/1060-19-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/1060-13-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/1060-12-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-14-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-15-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/1060-11-0x00007FFC95D3F000-0x00007FFC95D40000-memory.dmp
memory/1060-17-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/1060-18-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/1060-9-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-20-0x00007FFC52FF0000-0x00007FFC53000000-memory.dmp
memory/1060-21-0x00007FFC52FF0000-0x00007FFC53000000-memory.dmp
memory/1060-30-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/1060-54-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-56-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-57-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-10-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-8-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-55-0x00007FFC55D20000-0x00007FFC55D30000-memory.dmp
memory/1060-58-0x00007FFC95BE0000-0x00007FFC95E43000-memory.dmp
memory/2952-133-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-152-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-173-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-107-0x0000000010000000-0x000000001002D000-memory.dmp
memory/2952-117-0x000000006F3E0000-0x000000006F3F0000-memory.dmp
memory/2952-120-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-140-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-139-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-138-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-136-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-135-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-134-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-174-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-132-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-131-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-128-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-127-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-137-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-130-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-129-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-145-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-144-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-146-0x0000000002460000-0x00000000024DC000-memory.dmp
memory/2952-148-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-155-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-154-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-153-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-178-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-157-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-158-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-159-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-167-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-166-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-165-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-164-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-163-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-161-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-160-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-162-0x00000000033F0000-0x000000000343D000-memory.dmp
memory/2952-172-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-184-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-180-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-179-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-177-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-176-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-175-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-183-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-185-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-182-0x0000000004610000-0x0000000004739000-memory.dmp
memory/2952-181-0x0000000004610000-0x0000000004739000-memory.dmp
memory/3324-65-0x0000000000CC0000-0x0000000000D9C000-memory.dmp
memory/3324-104-0x0000000000CC0000-0x0000000000D9C000-memory.dmp
memory/4924-103-0x0000000000670000-0x0000000000AA7000-memory.dmp