Analysis
- user interaction
yes - max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 18:01
General
- Target SBMMOFF-Setup-v5.3.461.exe
- Size 34.9MB
- Sample261024-wl9eeabv3y
- SHA256 c256eac76e5bf27639ed1bfa30f4b7545378e3de825dc39a9010db21ffe0206b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in Program Files directory 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SBMMOFF-Setup-v5.3.461.exe"C:\Users\Admin\AppData\Local\Temp\SBMMOFF-Setup-v5.3.461.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3GQZAHY2CJ.tmp\SBMMOFF-Setup-v5.3.461.tmp"C:\Users\Admin\AppData\Local\Temp\is-3GQZAHY2CJ.tmp\SBMMOFF-Setup-v5.3.461.tmp" /SL5="$B0230,35349527,858624,C:\Users\Admin\AppData\Local\Temp\SBMMOFF-Setup-v5.3.461.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-I23JP25UQK.tmp\SBMMOFF-Installer-Migration.ps1" -Phase preinstall -TargetDir "C:\Program Files (x86)\Sbmmoff VPN"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" C:\ProgramData\SBMMOFF\InstallerMigration\v5.3.363 /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-I23JP25UQK.tmp\SBMMOFF-Installer-Migration.ps1" -Phase restore -TargetDir "C:\Program Files (x86)\Sbmmoff VPN"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" C:\ProgramData\SBMMOFF\InstallerMigration\v5.3.363 /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Sbmmoff_VPN.exe
is-3B2NVGT31O.tmp
is-606CVWYLZV.tmp
is-C0P3MLVAFN.tmp
is-U9GD3R4JH8.tmp
Malaysia.jpg
is-331B58DPGS.tmp
is-47IUMHFV7M.tmp
is-H0E0JR9MEQ.tmp
is-KZJ4F9YYOK.tmp
is-MPK4GQ0KRZ.tmp
is-N5I8OOQ1WJ.tmp
is-PU2II6ASC8.tmp
migration.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lqwnwxkr.d2g.psm1
SBMMOFF-Setup-v5.3.461.tmp
SBMMOFF-Installer-Migration.ps1
memory/2032-17-0x0000000004F90000-0x0000000004FB2000-memory.dmp
memory/2032-16-0x0000000072840000-0x0000000072FFC000-memory.dmp
memory/2032-27-0x0000000006350000-0x000000000636A000-memory.dmp
memory/2032-29-0x0000000007640000-0x0000000007BFA000-memory.dmp
memory/2032-31-0x0000000008280000-0x00000000088FC000-memory.dmp
memory/2032-34-0x0000000072840000-0x0000000072FFC000-memory.dmp
memory/2032-26-0x0000000006FE0000-0x0000000007076000-memory.dmp
memory/2032-24-0x0000000005D90000-0x0000000005DDC000-memory.dmp
memory/2032-23-0x0000000005D60000-0x0000000005D7E000-memory.dmp
memory/2032-22-0x0000000005880000-0x0000000005BDB000-memory.dmp
memory/2032-19-0x0000000005810000-0x0000000005876000-memory.dmp
memory/2032-18-0x00000000057A0000-0x0000000005806000-memory.dmp
memory/2032-12-0x0000000072852000-0x0000000072853000-memory.dmp
memory/2032-28-0x0000000006F40000-0x0000000006F62000-memory.dmp
memory/2032-15-0x0000000005060000-0x00000000056AA000-memory.dmp
memory/2032-14-0x0000000072840000-0x0000000072FFC000-memory.dmp
memory/2032-13-0x0000000002860000-0x0000000002896000-memory.dmp
memory/3248-1-0x0000000000540000-0x0000000000620000-memory.dmp
memory/3248-8-0x0000000000540000-0x0000000000620000-memory.dmp
memory/3248-1039-0x0000000000540000-0x0000000000620000-memory.dmp
memory/4204-9-0x0000000000560000-0x000000000099B000-memory.dmp
memory/4204-10-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/4204-1032-0x0000000000560000-0x000000000099B000-memory.dmp
memory/4204-6-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/4204-1038-0x0000000000560000-0x000000000099B000-memory.dmp
memory/4748-1027-0x0000000005D10000-0x000000000606B000-memory.dmp
memory/4748-1031-0x00000000062D0000-0x000000000631C000-memory.dmp