Analysis
- user interaction
yes - max time kernel
121s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 12:54
General
- Target Instalador_Oficial_DragonAI.exe
- Size 270.0MB
- Sample261030-p5manaef64
- SHA256 92c19cd360ba543ccce0c9e19cae28f7faf84a905d60d54e2f08b2d8f18cba5c
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 10 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Instalador_Oficial_DragonAI.exe"C:\Users\Admin\AppData\Local\Temp\Instalador_Oficial_DragonAI.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UIG4H5BOW2.tmp\Instalador_Oficial_DragonAI.tmp"C:\Users\Admin\AppData\Local\Temp\is-UIG4H5BOW2.tmp\Instalador_Oficial_DragonAI.tmp" /SL5="$E0116,281687524,1051136,C:\Users\Admin\AppData\Local\Temp\Instalador_Oficial_DragonAI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
is-7A3XU56I8F.tmp
is-R48HBSVXLZ.tmp
is-3CANB8UKRI.tmp
is-JTLTF52F4B.tmp
intro_video.mp4
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
btn_click_heartsteel.mp3
btn_hover_heal.mp3
DummyUpdater.exe
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
e_sqlite3.dll
wpfgfx_cor3.dll
Instalador_Oficial_DragonAI.tmp
session.lock
memory/532-37-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
memory/532-434-0x0000000000CE0000-0x000000000114A000-memory.dmp
memory/532-372-0x0000000000CE0000-0x000000000114A000-memory.dmp
memory/532-36-0x0000000000CE0000-0x000000000114A000-memory.dmp
memory/532-5-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
memory/1556-435-0x00000000006E0000-0x00000000007EF000-memory.dmp
memory/1556-35-0x00000000006E0000-0x00000000007EF000-memory.dmp
memory/1556-0-0x00000000006E0000-0x00000000007EF000-memory.dmp
memory/4848-588-0x0000019C2BF00000-0x0000019C2BFB0000-memory.dmp
memory/4848-496-0x0000015B91270000-0x0000015B912A0000-memory.dmp
memory/4848-500-0x0000015B912A0000-0x0000015B912C0000-memory.dmp
memory/4848-511-0x0000015B912D0000-0x0000015B91320000-memory.dmp
memory/4848-515-0x0000019C297D0000-0x0000019C29F70000-memory.dmp
memory/4848-519-0x0000019C28CB0000-0x0000019C28CE0000-memory.dmp
memory/4848-464-0x0000019C26850000-0x0000019C27080000-memory.dmp
memory/4848-448-0x0000015B8EF70000-0x0000015B8EFB0000-memory.dmp
memory/4848-548-0x0000019C2A300000-0x0000019C2A350000-memory.dmp
memory/4848-552-0x0000019C2A850000-0x0000019C2A910000-memory.dmp
memory/4848-568-0x0000015B89BB0000-0x0000015B89BC0000-memory.dmp
memory/4848-572-0x0000019C2B580000-0x0000019C2B5F0000-memory.dmp
memory/4848-576-0x0000019C2B7F0000-0x0000019C2B950000-memory.dmp
memory/4848-592-0x0000019C2C290000-0x0000019C2C490000-memory.dmp
memory/4848-452-0x0000015B89BF0000-0x0000015B89C00000-memory.dmp
memory/4848-584-0x0000019C2BD80000-0x0000019C2BDF0000-memory.dmp
memory/4848-580-0x0000019C2BBD0000-0x0000019C2BD80000-memory.dmp
memory/4848-564-0x0000019C2AF70000-0x0000019C2AFB0000-memory.dmp
memory/4848-560-0x0000019C2AF10000-0x0000019C2AF70000-memory.dmp
memory/4848-556-0x0000019C2A720000-0x0000019C2A740000-memory.dmp
memory/4848-544-0x0000019C28FD0000-0x0000019C28FF0000-memory.dmp
memory/4848-540-0x0000019C2A4D0000-0x0000019C2A640000-memory.dmp
memory/4848-536-0x0000019C28CE0000-0x0000019C28D00000-memory.dmp
memory/4848-532-0x0000019C28F50000-0x0000019C28F80000-memory.dmp
memory/4848-523-0x0000019C28DC0000-0x0000019C28E50000-memory.dmp
memory/4848-507-0x0000019C28BA0000-0x0000019C28CB0000-memory.dmp
memory/4848-456-0x0000015B8F000000-0x0000015B8F050000-memory.dmp
memory/4848-484-0x0000015B91160000-0x0000015B91180000-memory.dmp
memory/4848-492-0x0000015B91200000-0x0000015B91220000-memory.dmp
memory/4848-488-0x0000015B911A0000-0x0000015B911C0000-memory.dmp
memory/4848-480-0x0000015B91000000-0x0000015B91020000-memory.dmp
memory/4848-476-0x0000015B8B530000-0x0000015B8B540000-memory.dmp
memory/4848-472-0x0000015B8F050000-0x0000015B8F070000-memory.dmp
memory/4848-468-0x0000015B910A0000-0x0000015B91120000-memory.dmp
memory/4848-596-0x0000019C2C590000-0x0000019C2C690000-memory.dmp
memory/4848-616-0x0000019C2C010000-0x0000019C2C020000-memory.dmp
memory/4848-460-0x0000015B90F90000-0x0000015B90FD0000-memory.dmp
memory/4848-620-0x0000019C2D2D0000-0x0000019C2D590000-memory.dmp
memory/4848-612-0x0000019C2C000000-0x0000019C2C010000-memory.dmp
memory/4848-608-0x0000019C2BA00000-0x0000019C2BA20000-memory.dmp
memory/4848-604-0x0000019C2BE20000-0x0000019C2BE50000-memory.dmp
memory/4848-600-0x0000019C2B640000-0x0000019C2B660000-memory.dmp
memory/4848-631-0x0000019C2CF10000-0x0000019C2CF30000-memory.dmp
memory/4848-627-0x0000019C2D590000-0x0000019C2D620000-memory.dmp
memory/4848-638-0x0000019C2D620000-0x0000019C2D670000-memory.dmp
memory/4848-642-0x0000019C2CF00000-0x0000019C2CF10000-memory.dmp
memory/4848-444-0x0000015B8BB90000-0x0000015B8BCF0000-memory.dmp
memory/4848-655-0x0000019C2D810000-0x0000019C2D840000-memory.dmp
memory/4848-437-0x0000015B8FFF0000-0x0000015B90F50000-memory.dmp
memory/4848-664-0x0000019C2D9B0000-0x0000019C2D9C0000-memory.dmp
memory/4848-440-0x0000015B8EBE0000-0x0000015B8EE10000-memory.dmp
memory/4848-430-0x0000015B8C990000-0x0000015B8D620000-memory.dmp
memory/4848-1012-0x0000019C324B0000-0x0000019C324C0000-memory.dmp