Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 12:16
General
- Target LocalSend-1.18.2-windows-x86-64.exe
- Size 19.0MB
- Sample261024-pfymdsbx3l
- SHA256 122783e6abb4b0a1f1603d896f46a03aeda3004479ebd3175cab4ddac6b60919
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 23 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LocalSend-1.18.2-windows-x86-64.exe"C:\Users\Admin\AppData\Local\Temp\LocalSend-1.18.2-windows-x86-64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LZJAO12FUT.tmp\LocalSend-1.18.2-windows-x86-64.tmp"C:\Users\Admin\AppData\Local\Temp\is-LZJAO12FUT.tmp\LocalSend-1.18.2-windows-x86-64.tmp" /SL5="$4009E,18561117,947712,C:\Users\Admin\AppData\Local\Temp\LocalSend-1.18.2-windows-x86-64.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -Command Add-AppxPackage .\localsend_msix_helper.msix -ExternalLocation $(Get-Location)3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\LocalSend\localsend_app.exe"C:\Program Files\LocalSend\localsend_app.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$TargetPath = \"C:\Program Files\LocalSend\localsend_app.exe\" $ShortcutFile = \"C:\Users\Admin\AppData\Roaming/Microsoft/Windows/SendTo/LocalSend.lnk\" $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut($ShortcutFile) $Shortcut.TargetPath = $TargetPath $Shortcut.Save() "4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
connectivity_plus_plugin.dll
app.so
AssetManifest.bin
FontManifest.json
NativeAssetsManifest.json
logo-512.png
logo.ico
MaterialIcons-Regular.otf
icudtl.dat
desktop_drop_plugin.dll
dynamic_color_plugin.dll
file_selector_windows_plugin.dll
flutter_windows.dll
gal_plugin.dll
localsend_app.exe
msvcp140.dll
open_dir_windows_plugin.dll
pasteboard_plugin.dll
permission_handler_windows_plugin.dll
rust_lib_localsend_app.dll
screen_retriever_windows_plugin.dll
tray_manager_plugin.dll
uri_content_plugin.dll
url_launcher_windows_plugin.dll
vcruntime140.dll
vcruntime140_1.dll
window_manager_plugin.dll
windows_taskbar_plugin.dll
StartupProfileData-NonInteractive
__PSScriptPolicyTest_gtklwg44.duv.psm1
LocalSend-1.18.2-windows-x86-64.tmp
settings.json
LocalSend.lnk
memory/2920-200-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-195-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-217-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-214-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-213-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-212-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-211-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-186-0x00007FFB0212F000-0x00007FFB02130000-memory.dmp
memory/2920-201-0x000001E36F200000-0x000001E36F404000-memory.dmp
memory/2920-203-0x000001E36F0A0000-0x000001E36F0CA000-memory.dmp
memory/2920-204-0x000001E36E7D0000-0x000001E36E7D8000-memory.dmp
memory/2920-205-0x000001E36EDC0000-0x000001E36EDC6000-memory.dmp
memory/2920-208-0x000001E36F050000-0x000001E36F076000-memory.dmp
memory/2920-207-0x000001E36F010000-0x000001E36F018000-memory.dmp
memory/2920-206-0x000001E36EDD0000-0x000001E36EDDA000-memory.dmp
memory/2920-202-0x000001E36EFF0000-0x000001E36F00A000-memory.dmp
memory/2920-199-0x000001E36EDE0000-0x000001E36EE92000-memory.dmp
memory/2920-187-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-198-0x000001E36EDC0000-0x000001E36EDDE000-memory.dmp
memory/2920-215-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-194-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-190-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-191-0x000001E36E7E0000-0x000001E36E802000-memory.dmp
memory/2920-192-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/2920-193-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp
memory/3368-264-0x0000022C26890000-0x0000022C277E5000-memory.dmp
memory/3368-263-0x0000022C26780000-0x0000022C26781000-memory.dmp
memory/3368-266-0x0000022C26890000-0x0000022C277E5000-memory.dmp
memory/3368-265-0x0000022C26890000-0x0000022C277E5000-memory.dmp
memory/3368-267-0x0000022C26790000-0x0000022C26791000-memory.dmp
memory/4176-276-0x0000000000D70000-0x0000000000E66000-memory.dmp
memory/4176-0-0x0000000000D70000-0x0000000000E66000-memory.dmp
memory/4176-7-0x0000000000D70000-0x0000000000E66000-memory.dmp
memory/4788-275-0x00000000008B0000-0x0000000000D00000-memory.dmp
memory/4788-210-0x00000000008B0000-0x0000000000D00000-memory.dmp
memory/4788-14-0x00000000008B0000-0x0000000000D00000-memory.dmp
memory/4788-12-0x00000000008B0000-0x0000000000D00000-memory.dmp
memory/4788-8-0x00000000008B0000-0x0000000000D00000-memory.dmp
memory/4788-9-0x0000000001200000-0x0000000001201000-memory.dmp
memory/4788-6-0x0000000001200000-0x0000000001201000-memory.dmp