Overview

overview

7

Static

static

3

Core-Temp-...07.exe

windows10-2004-x64

7

Core-Temp-...07.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/10/2026, 22:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Core-Temp-setup-v1.21.0.207.exe
  • Size 1.7MB
  • Sample261016-2qlrssxy6p
  • SHA256 fbf053db5567d55d20f8d54b8930e95914ffd44073a62ed71ac9048c89d4ecb6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 41 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Core-Temp-setup-v1.21.0.207.exe
    "C:\Users\Admin\AppData\Local\Temp\Core-Temp-setup-v1.21.0.207.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\is-D6SF8.tmp\Core-Temp-setup-v1.21.0.207.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D6SF8.tmp\Core-Temp-setup-v1.21.0.207.tmp" /SL5="$502EC,1394059,121344,C:\Users\Admin\AppData\Local\Temp\Core-Temp-setup-v1.21.0.207.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Core Temp\Readme.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1756
      • C:\Program Files\Core Temp\Core Temp.exe
        "C:\Program Files\Core Temp\Core Temp.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:2460
  • C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys
    C:\Users\Admin\AppData\Local\Temp\\ALSysIO64.sys
    1⤵
    • Executes dropped EXE
    PID:4212

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Core Temp.exe
        • Path C:\Program Files\Core Temp\Core Temp.exe
        • Size 1.9MB
        • SHA256 2b71f05ae03993012d11434997ffd420794ad55e7c70268c4b9295fab0a71e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CoreTemp.ini
        • Path C:\Program Files\Core Temp\CoreTemp.ini
        • Size 1000B
        • SHA256 862fcf5ca6557dfa2419c6680fcb2b03b997fc89746ebb3e77c1bf91ce6e244b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CoreTemp.ini
        • Path C:\Program Files\Core Temp\CoreTemp.ini
        • Size 977B
        • SHA256 1f205f768d5aede2dd8d85f84060854eb3b967bfe04b354047cc9366bc3d3e80
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Readme.txt
        • Path C:\Program Files\Core Temp\Readme.txt
        • Size 3KB
        • SHA256 abb84cf36bd0e8f39248f5477ca0d427da9b7e3c10b6666254b98d6e06b40e7b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ab-AB.lng
        • Path C:\Program Files\Core Temp\languages\ab-AB.lng
        • Size 64KB
        • SHA256 5e82337d45bea01a7de4f1012b21fb1343434fd507e42ae3a3871af290f99b0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg-BG.lng
        • Path C:\Program Files\Core Temp\languages\bg-BG.lng
        • Size 62KB
        • SHA256 6f0aca0468fd4a4422c2d4ee90812de74dceafbf7b3a86ccea627c266c6a6a39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ca.lng
        • Path C:\Program Files\Core Temp\languages\ca.lng
        • Size 59KB
        • SHA256 dab41a2243320bfda091cca6d52db30cf0086ddf62c17dd696efc6999e02a83d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cs.lng
        • Path C:\Program Files\Core Temp\languages\cs.lng
        • Size 56KB
        • SHA256 2033aba3eaa3194087a69b98dcbe0e2a151f89d259fa4328da0087106c434b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        da-DK.lng
        • Path C:\Program Files\Core Temp\languages\da-DK.lng
        • Size 59KB
        • SHA256 fc5a428706d416c6d6cedf7d69fe807200f783b4c595b8f422196a76a273d620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        de-DE.lng
        • Path C:\Program Files\Core Temp\languages\de-DE.lng
        • Size 59KB
        • SHA256 ddfc32147269075ab40177ebde89d8297d41796339798faeadd587391a6f5be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        el-GR.lng
        • Path C:\Program Files\Core Temp\languages\el-GR.lng
        • Size 61KB
        • SHA256 f03c7d416242a4eee9e9c29497ab987cc04c540f97f5fe8228f8ae614ecb57f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es.lng
        • Path C:\Program Files\Core Temp\languages\es.lng
        • Size 55KB
        • SHA256 fa00264d4b1c9857868d4f8b3917cc61cdb156e2258405bc2b349b546cfb5424
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fi-Fi.lng
        • Path C:\Program Files\Core Temp\languages\fi-Fi.lng
        • Size 54KB
        • SHA256 1cb214e2e168d007aee191b2aa18383a0bf1f07d40c0aa248334870c0772b77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fr-FR.lng
        • Path C:\Program Files\Core Temp\languages\fr-FR.lng
        • Size 66KB
        • SHA256 1cc20bea9a9dfcaa3e037284f91ef6269c7f94b27bdbb3737fbbdd89d65325bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gal-GZ.lng
        • Path C:\Program Files\Core Temp\languages\gal-GZ.lng
        • Size 55KB
        • SHA256 86cf59301dbc6f1eca8cd4ff31e3d229fc3f4fbd78af370e6ae3f4fc46d1d51a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        he-IL.lng
        • Path C:\Program Files\Core Temp\languages\he-IL.lng
        • Size 68KB
        • SHA256 e80ba2e23e5f371e89dfdccdea12999cdc7a1370b5a2d6fcb366bb95ab27c2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hu-HU.lng
        • Path C:\Program Files\Core Temp\languages\hu-HU.lng
        • Size 56KB
        • SHA256 a7494cdd484352ad3a50039d53f60178e22343c5902fca4975dd448391875a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hy-AM.lng
        • Path C:\Program Files\Core Temp\languages\hy-AM.lng
        • Size 64KB
        • SHA256 8f745f107724a0f60f0438252b970c463b1e5ceabbf00abf1074c0a3f0d953b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        it-IT.lng
        • Path C:\Program Files\Core Temp\languages\it-IT.lng
        • Size 60KB
        • SHA256 c2915702e142fa0da9874110af0c029ad515f017428488174d844d11fbacf7ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ja-JP.lng
        • Path C:\Program Files\Core Temp\languages\ja-JP.lng
        • Size 61KB
        • SHA256 6d4999f4cb13095c897f3be5dc2d784cbc6682c0e05399717f66a6f873f26f30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ko-KR.lng
        • Path C:\Program Files\Core Temp\languages\ko-KR.lng
        • Size 55KB
        • SHA256 da80baad337b5f713fe5295fb312f0dfc5e576c6534a5124c8fa396196e4386b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nb-NO.lng
        • Path C:\Program Files\Core Temp\languages\nb-NO.lng
        • Size 59KB
        • SHA256 384804a74c57bce53a0c50723ef65a3923014b75ded42ea58e4fb36d8fe3124d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nl-NL.lng
        • Path C:\Program Files\Core Temp\languages\nl-NL.lng
        • Size 55KB
        • SHA256 9557fc1335568b2461768cf8b4c320005cfee2ef7ed4aecb7de2869e0a7db8a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pl-PL.lng
        • Path C:\Program Files\Core Temp\languages\pl-PL.lng
        • Size 56KB
        • SHA256 9b30148ff971dc3b33279bd44bf5019d224c7c5514199b695276b69be3e44e2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pt-BR.lng
        • Path C:\Program Files\Core Temp\languages\pt-BR.lng
        • Size 57KB
        • SHA256 7e8ec5b70967d1c67053b011c28382af3913006f22ed22066887ed2d7666f2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ro-RO.lng
        • Path C:\Program Files\Core Temp\languages\ro-RO.lng
        • Size 60KB
        • SHA256 673296a2ccf2322dc0be4c7bb5af1ea1d38c9002d164f2dd0436b46dbcb76493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ru-RU.lng
        • Path C:\Program Files\Core Temp\languages\ru-RU.lng
        • Size 72KB
        • SHA256 35b37c757e10219fef6ce09c2fd4d67af0fd31c185d50d660b6f63c7ffe85fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sk.lng
        • Path C:\Program Files\Core Temp\languages\sk.lng
        • Size 55KB
        • SHA256 9e4f20a6df5e023b6b2ce4382f55619400e9973bce95d88a6ff386567b7b11ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sl-SI.lng
        • Path C:\Program Files\Core Temp\languages\sl-SI.lng
        • Size 66KB
        • SHA256 ececd09b5f1c4cfcac19d0e7e3d1a9e44d5cbbcbf0614b50af899720080ff36e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sv-SE.lng
        • Path C:\Program Files\Core Temp\languages\sv-SE.lng
        • Size 59KB
        • SHA256 cd6c153ba40f50a290d176a6de270bdbb836d824bf158115c18fe006d397c07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tr-TR.lng
        • Path C:\Program Files\Core Temp\languages\tr-TR.lng
        • Size 55KB
        • SHA256 d89292672c1e000171b677dd6f9e9ea82c1cc814f9eec5c806b2ece08b8f7bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uk-UA.lng
        • Path C:\Program Files\Core Temp\languages\uk-UA.lng
        • Size 70KB
        • SHA256 76bd25ed0ba960a9d66feec3d27a5725aadbeac87364af3913ada471932cdf72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vi-VN.lng
        • Path C:\Program Files\Core Temp\languages\vi-VN.lng
        • Size 56KB
        • SHA256 976a535f38d131425d4bab12f09ef0d20df63b775596643932e0545d415683ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-CN.lng
        • Path C:\Program Files\Core Temp\languages\zh-CN.lng
        • Size 54KB
        • SHA256 914f26d00bd9fdaaebcbb7f63f193add1c2c996651edccb9509f9a87e54ffba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-TW.lng
        • Path C:\Program Files\Core Temp\languages\zh-TW.lng
        • Size 57KB
        • SHA256 c142c01eefa9d341543e68e7d134fda49915ab58b616769f5880e658b2a956d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unins000.exe
        • Path C:\Program Files\Core Temp\unins000.exe
        • Size 1.2MB
        • SHA256 f515206b2c2fd3a59cf6f003143efca98456e2bdc4b7a8f622beb98f735cf667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ALSysIO64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sys
        • Size 76KB
        • SHA256 8f801e964546656e697830979b0d86daef5c40dd66561c0a371a3b2c57637dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Core-Temp-setup-v1.21.0.207.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-D6SF8.tmp\Core-Temp-setup-v1.21.0.207.tmp
        • Size 1.1MB
        • SHA256 9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1676-5-0x0000000000810000-0x0000000000811000-memory.dmp
        Download

        memory/1676-175-0x0000000000400000-0x000000000052E000-memory.dmp
        Download

        memory/1676-8-0x0000000000400000-0x000000000052E000-memory.dmp
        Download

        memory/1676-9-0x0000000000810000-0x0000000000811000-memory.dmp
        Download

        memory/4656-0-0x0000000000400000-0x0000000000428000-memory.dmp
        Download

        memory/4656-176-0x0000000000400000-0x0000000000428000-memory.dmp
        Download

        memory/4656-7-0x0000000000400000-0x0000000000428000-memory.dmp
        Download