Analysis
- max time kernel
601s - max time network
478s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 04:32
General
- Target Eclipse-Setup-0.6.39.exe
- Size 60.2MB
- Sample261017-e5yzcawzcw
- SHA256 7eb43537e06e2612d4ec3fab0bbd06219d02021ee694a1849e030d85aebe44ce
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 62 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies Control Panel 1 IoCs
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eclipse-Setup-0.6.39.exe"C:\Users\Admin\AppData\Local\Temp\Eclipse-Setup-0.6.39.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UYK6OABDVM.tmp\Eclipse-Setup-0.6.39.tmp"C:\Users\Admin\AppData\Local\Temp\is-UYK6OABDVM.tmp\Eclipse-Setup-0.6.39.tmp" /SL5="$401D6,61815649,939520,C:\Users\Admin\AppData\Local\Temp\Eclipse-Setup-0.6.39.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Eclipse\Eclipse.exe"C:\Users\Admin\AppData\Local\Programs\Eclipse\Eclipse.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
crash.log
CommunityToolkit.WinUI.UI.Controls.Primitives.dll
CoreMessagingXP.dll
Eclipse.deps.json
Eclipse.dll
Eclipse.exe
Eclipse.pri
Eclipse.runtimeconfig.json
MRM.dll
Microsoft.InteractiveExperiences.Projection.dll
Microsoft.Internal.FrameworkUdk.dll
Microsoft.UI.Windowing.Core.dll
Microsoft.UI.Xaml.Controls.dll
Microsoft.UI.Xaml.Phone.dll
Microsoft.UI.Xaml.dll
Microsoft.Web.WebView2.Core.Projection.dll
Microsoft.WinUI.dll
Microsoft.Windows.ApplicationModel.Resources.dll
Microsoft.Windows.SDK.NET.dll
Microsoft.WindowsAppRuntime.dll
System.Collections.Concurrent.dll
System.Collections.dll
System.ComponentModel.dll
System.Memory.dll
System.Numerics.Vectors.dll
System.ObjectModel.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Runtime.InteropServices.dll
System.Runtime.dll
System.Security.Cryptography.dll
System.Threading.dll
WinRT.Runtime.dll
clrjit.dll
coreclr.dll
Microsoft.UI.Xaml.dll.mui
hostfxr.dll
hostpolicy.dll
is-KDDDTB3P2G.tmp
Eclipse-Setup-0.6.39.tmp
memory/2028-12-0x0000000000280000-0x00000000006CF000-memory.dmp
memory/2028-10-0x00000000017B0000-0x00000000017B1000-memory.dmp
memory/2028-9-0x0000000000280000-0x00000000006CF000-memory.dmp
memory/2028-384-0x0000000000280000-0x00000000006CF000-memory.dmp
memory/2028-1629-0x0000000000280000-0x00000000006CF000-memory.dmp
memory/2028-1656-0x0000000000280000-0x00000000006CF000-memory.dmp
memory/2028-6-0x00000000017B0000-0x00000000017B1000-memory.dmp
memory/4612-8-0x0000000000790000-0x0000000000884000-memory.dmp
memory/4612-1-0x0000000000790000-0x0000000000884000-memory.dmp
memory/4612-1657-0x0000000000790000-0x0000000000884000-memory.dmp