Analysis
- max time kernel
39s - max time network
19s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 04:04
General
- Target 038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752.exe
- Size 25.7MB
- Sample261030-em6apsvzcw
- SHA256 038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752.exe"C:\Users\Admin\AppData\Local\Temp\038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UIJ7D.tmp\038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752.tmp"C:\Users\Admin\AppData\Local\Temp\is-UIJ7D.tmp\038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752.tmp" /SL5="$400C2,26165723,779264,C:\Users\Admin\AppData\Local\Temp\038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\is-O44AH.tmp\__exo.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jzanloku\jzanloku.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DB0.tmp" "c:\Users\Admin\AppData\Local\Temp\jzanloku\CSC51E0D3CC51644F508EDD5F9240D67626.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES8DB0.tmp
__PSScriptPolicyTest_0sw0jk2t.5ao.psm1
__exo.ps1
038fb6a3b1cbb208f05b372e085a1588a8d6701ff247b1700eae01008b7b9752.tmp
jzanloku.dll
deyi.dll
CSC51E0D3CC51644F508EDD5F9240D67626.TMP
jzanloku.0.cs
jzanloku.cmdline
memory/280-78-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/280-2-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/280-0-0x00000000004C2000-0x00000000004C3000-memory.dmp
memory/280-56-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/5972-39-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-41-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-45-0x000001EDE9DD0000-0x000001EDE9E82000-memory.dmp
memory/5972-46-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-47-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-48-0x000001EDE9E90000-0x000001EDE9E9A000-memory.dmp
memory/5972-49-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-50-0x000001EDE9EC0000-0x000001EDE9EDE000-memory.dmp
memory/5972-51-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-52-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-53-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-54-0x000001EDEA750000-0x000001EDEA77A000-memory.dmp
memory/5972-55-0x000001EDEA750000-0x000001EDEA774000-memory.dmp
memory/5972-44-0x000001EDE9DB0000-0x000001EDE9DCE000-memory.dmp
memory/5972-40-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-37-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-36-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-33-0x000001EDE9D20000-0x000001EDE9D42000-memory.dmp
memory/5972-32-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-69-0x000001EDE9EA0000-0x000001EDE9EA8000-memory.dmp
memory/5972-31-0x00007FF9F076F000-0x00007FF9F0770000-memory.dmp
memory/5972-76-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/5972-75-0x00007FF9F05E0000-0x00007FF9F0F84000-memory.dmp
memory/6136-72-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/6136-71-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/6136-77-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/6136-7-0x0000000000400000-0x00000000006EE000-memory.dmp