Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 22:08
General
- Target supremo-windows.exe
- Size 13.7MB
- Sample261027-12bwasvx8j
- SHA256 893b83b5eba2ee1fcb0028d68c4c5965e811cdd31a870c1bd93dd6f00e276ca2
Malware Config
Signatures
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 9 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\supremo-windows.exe"C:\Users\Admin\AppData\Local\Temp\supremo-windows.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exe"C:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exe" "C:\Users\Admin\AppData\Local\Temp\supremo-windows.exe" /wait 3360 /sysrun2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exeC:\Users\Admin\AppData\Local\Temp\SupremoRemoteDesktop\SupremoSystem.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\supremo-windows.exe"C:\Users\Admin\AppData\Local\Temp\supremo-windows.exe" /wait 3360 /sysrun2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\SupremoRemoteDesktop\S-1-5-21-696679853-3915825385-3233721679-1000\SupremoHelper.exe"C:\Windows\Temp\SupremoRemoteDesktop\S-1-5-21-696679853-3915825385-3233721679-1000\SupremoHelper.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Settings.bak
Settings.dat
SupremoSystem.exe
libcrypto-3.dll
libssl-3.dll
SupremoHelper.exe
openh264-2.6.0-win32.dll
memory/248-93-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-101-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-131-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-127-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-124-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-120-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-116-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-113-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-109-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-104-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-66-0x0000000005490000-0x0000000005491000-memory.dmp
memory/248-97-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-89-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-83-0x0000000000740000-0x0000000000E1B000-memory.dmp
memory/248-64-0x0000000005480000-0x0000000005481000-memory.dmp
memory/248-68-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/248-70-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/2664-37-0x0000000008210000-0x0000000008211000-memory.dmp
memory/2664-81-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/2664-43-0x0000000008240000-0x0000000008241000-memory.dmp
memory/2664-39-0x0000000008220000-0x0000000008221000-memory.dmp
memory/2664-90-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/2664-41-0x0000000008230000-0x0000000008231000-memory.dmp
memory/2664-87-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/3360-84-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/3360-1-0x000000000040B000-0x000000000040C000-memory.dmp
memory/3360-0-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/3360-30-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/3360-2-0x0000000007940000-0x0000000007941000-memory.dmp
memory/3360-10-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/3360-33-0x0000000000400000-0x0000000003E43000-memory.dmp
memory/3360-3-0x0000000007940000-0x0000000007941000-memory.dmp
memory/3360-9-0x0000000007970000-0x0000000007971000-memory.dmp
memory/3360-7-0x0000000007960000-0x0000000007961000-memory.dmp
memory/3360-5-0x0000000007950000-0x0000000007951000-memory.dmp
memory/4664-34-0x0000000000400000-0x000000000055D000-memory.dmp
memory/5668-35-0x0000000000400000-0x000000000055D000-memory.dmp