Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 04:48
General
- Target Pulse-Navisworks-Setup-v0.4.0.exe
- Size 25.7MB
- Sample261027-fe9tlabv5n
- SHA256 de0855780cb1ba65df5e2b1ea7b953254bb1f4ac407a6a99fabea7bcf18d3d8a
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pulse-Navisworks-Setup-v0.4.0.exe"C:\Users\Admin\AppData\Local\Temp\Pulse-Navisworks-Setup-v0.4.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GWTUFSIRGV.tmp\Pulse-Navisworks-Setup-v0.4.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-GWTUFSIRGV.tmp\Pulse-Navisworks-Setup-v0.4.0.tmp" /SL5="$400A0,25712606,868352,C:\Users\Admin\AppData\Local\Temp\Pulse-Navisworks-Setup-v0.4.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C taskkill /F /T /IM Pulse.Navisworks.Server.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exetaskkill /F /T /IM Pulse.Navisworks.Server.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\.pulse\navisworks\install.ps1" -Silent3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3abosq2r\3abosq2r.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9011.tmp" "c:\Users\Admin\AppData\Local\Temp\3abosq2r\CSC1B2DB68061C64C3290F608145C07954.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3abosq2r.dll
RES9011.tmp
__PSScriptPolicyTest_e5gcn0ww.n30.psm1
Pulse-Navisworks-Setup-v0.4.0.tmp
INSTALL_NO_NAVISWORKS.flag
install.ps1
ClaudeConfig.ps1
CodexConfig.ps1
GitInstall.ps1
McpClientDetect.ps1
McpJsonConfig.ps1
NavisDeploy.ps1
OpenCodeConfig.ps1
PulseLocale.ps1
is-8ZKIJJGQKH.tmp
is-AY9XFAK9Y5.tmp
is-C3N6USRL0M.tmp
is-DTI6R9F7TE.tmp
is-F4E3DK3F8M.tmp
is-F8O5D9U7AJ.tmp
is-FNOD0VOB4R.tmp
is-HVA4W7EY8H.tmp
is-I47YBI2OLH.tmp
is-IPDB4C4L6I.tmp
is-KE7R4DYRW0.tmp
is-KL6IFIVK1M.tmp
is-WSIZ48FZNK.tmp
is-XOU9P5YEPR.tmp
is-YNXE5OCJ4Q.tmp
is-Z5D05ONZA5.tmp
is-33W9ZJZJWL.tmp
is-4NA8D3KSXM.tmp
is-G7Z8L1P6RT.tmp
is-7HLMVKIU4W.tmp
is-XNAD4M44ZQ.tmp
3abosq2r.0.cs
3abosq2r.cmdline
CSC1B2DB68061C64C3290F608145C07954.TMP
memory/3256-1146-0x00000177AC4F0000-0x00000177AC50E000-memory.dmp
memory/3256-1118-0x00000177AC400000-0x00000177AC422000-memory.dmp
memory/3256-1145-0x00000177AC4C0000-0x00000177AC4CA000-memory.dmp
memory/3256-1144-0x00000177AC720000-0x00000177AC7D2000-memory.dmp
memory/3256-1143-0x00000177AC4A0000-0x00000177AC4BE000-memory.dmp
memory/3256-1140-0x00000177AC460000-0x00000177AC468000-memory.dmp
memory/3380-10-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/3380-9-0x0000000000730000-0x0000000000B6E000-memory.dmp
memory/3380-12-0x0000000000730000-0x0000000000B6E000-memory.dmp
memory/3380-1150-0x0000000000730000-0x0000000000B6E000-memory.dmp
memory/3380-6-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/3380-1152-0x0000000000730000-0x0000000000B6E000-memory.dmp
memory/3604-8-0x0000000000DB0000-0x0000000000E92000-memory.dmp
memory/3604-1-0x0000000000DB0000-0x0000000000E92000-memory.dmp
memory/3604-1153-0x0000000000DB0000-0x0000000000E92000-memory.dmp