Analysis
- user interaction
yes - max time kernel
152s - max time network
173s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 12:54
General
- Target Instalador_Oficial_DragonAI.exe
- Size 270.0MB
- Sample261030-p5manaef64
- SHA256 92c19cd360ba543ccce0c9e19cae28f7faf84a905d60d54e2f08b2d8f18cba5c
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Instalador_Oficial_DragonAI.exe"C:\Users\Admin\AppData\Local\Temp\Instalador_Oficial_DragonAI.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7ZOF4IIPUY.tmp\Instalador_Oficial_DragonAI.tmp"C:\Users\Admin\AppData\Local\Temp\is-7ZOF4IIPUY.tmp\Instalador_Oficial_DragonAI.tmp" /SL5="$501D0,281687524,1051136,C:\Users\Admin\AppData\Local\Temp\Instalador_Oficial_DragonAI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"C:\Users\Admin\AppData\Local\DragonAI\DragonAI.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
is-HKV7L0OC3Q.tmp
is-0TP2RREM5U.tmp
is-6I8ZP6JPPK.tmp
is-7UREY88FKO.tmp
intro_video.mp4
CurrentDatabase_400.wmdb
WMSDKNS.XML
btn_click_heartsteel.mp3
btn_hover_heal.mp3
DummyUpdater.exe
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
e_sqlite3.dll
wpfgfx_cor3.dll
Instalador_Oficial_DragonAI.tmp
session.lock
memory/4664-477-0x0000026F4E920000-0x0000026F4E940000-memory.dmp
memory/4664-553-0x0000026F045C0000-0x0000026F04610000-memory.dmp
memory/4664-455-0x0000026F4AE20000-0x0000026F4AE30000-memory.dmp
memory/4664-463-0x0000026F50910000-0x0000026F50950000-memory.dmp
memory/4664-746-0x0000026F07D20000-0x0000026F07D30000-memory.dmp
memory/4664-659-0x0000026F07EE0000-0x0000026F07F10000-memory.dmp
memory/4664-459-0x0000026F50880000-0x0000026F508D0000-memory.dmp
memory/4664-451-0x0000026F4E8C0000-0x0000026F4E900000-memory.dmp
memory/4664-439-0x0000026F4F8D0000-0x0000026F50830000-memory.dmp
memory/4664-469-0x0000026F00000000-0x0000026F00830000-memory.dmp
memory/4664-481-0x0000026F4E870000-0x0000026F4E880000-memory.dmp
memory/4664-489-0x0000026F50AE0000-0x0000026F50B00000-memory.dmp
memory/4664-497-0x0000026F50B80000-0x0000026F50BA0000-memory.dmp
memory/4664-505-0x0000026F50C20000-0x0000026F50C40000-memory.dmp
memory/4664-501-0x0000026F50BF0000-0x0000026F50C20000-memory.dmp
memory/4664-493-0x0000026F50B20000-0x0000026F50B40000-memory.dmp
memory/4664-513-0x0000026F026F0000-0x0000026F02800000-memory.dmp
memory/4664-516-0x0000026F50C50000-0x0000026F50CA0000-memory.dmp
memory/4664-443-0x0000026F4E4C0000-0x0000026F4E6F0000-memory.dmp
memory/4664-485-0x0000026F50980000-0x0000026F509A0000-memory.dmp
memory/4664-520-0x0000026F03320000-0x0000026F03AC0000-memory.dmp
memory/4664-524-0x0000026F02850000-0x0000026F02880000-memory.dmp
memory/4664-436-0x0000026F4C270000-0x0000026F4CF00000-memory.dmp
memory/4664-473-0x0000026F50A20000-0x0000026F50AA0000-memory.dmp
memory/4664-528-0x0000026F02960000-0x0000026F029F0000-memory.dmp
memory/4664-647-0x0000026F072F0000-0x0000026F07300000-memory.dmp
memory/4664-643-0x0000026F07A20000-0x0000026F07A70000-memory.dmp
memory/4664-537-0x0000026F02A20000-0x0000026F02A50000-memory.dmp
memory/4664-541-0x0000026F028B0000-0x0000026F028D0000-memory.dmp
memory/4664-545-0x0000026F04370000-0x0000026F044E0000-memory.dmp
memory/4664-549-0x0000026F02AA0000-0x0000026F02AC0000-memory.dmp
memory/4664-448-0x0000026F4B470000-0x0000026F4B5D0000-memory.dmp
memory/4664-561-0x0000026F02B50000-0x0000026F02B70000-memory.dmp
memory/4664-573-0x0000026F04670000-0x0000026F04680000-memory.dmp
memory/4664-569-0x0000026F04630000-0x0000026F04670000-memory.dmp
memory/4664-565-0x0000026F04DC0000-0x0000026F04E20000-memory.dmp
memory/4664-577-0x0000026F05960000-0x0000026F059D0000-memory.dmp
memory/4664-581-0x0000026F05BD0000-0x0000026F05D30000-memory.dmp
memory/4664-558-0x0000026F04740000-0x0000026F04800000-memory.dmp
memory/4664-589-0x0000026F06180000-0x0000026F061F0000-memory.dmp
memory/4664-593-0x0000026F06300000-0x0000026F063B0000-memory.dmp
memory/4664-597-0x0000026F06690000-0x0000026F06890000-memory.dmp
memory/4664-585-0x0000026F05FD0000-0x0000026F06180000-memory.dmp
memory/4664-601-0x0000026F06990000-0x0000026F06A90000-memory.dmp
memory/4664-613-0x0000026F05E00000-0x0000026F05E20000-memory.dmp
memory/4664-617-0x0000026F05D40000-0x0000026F05D50000-memory.dmp
memory/4664-625-0x0000026F076D0000-0x0000026F07990000-memory.dmp
memory/4664-621-0x0000026F05D80000-0x0000026F05D90000-memory.dmp
memory/4664-638-0x0000026F07320000-0x0000026F07340000-memory.dmp
memory/4664-609-0x0000026F06220000-0x0000026F06250000-memory.dmp
memory/4664-605-0x0000026F05D50000-0x0000026F05D70000-memory.dmp
memory/4664-632-0x0000026F07990000-0x0000026F07A20000-memory.dmp
memory/5496-468-0x0000000000DA0000-0x0000000000EAF000-memory.dmp
memory/5496-33-0x0000000000DA0000-0x0000000000EAF000-memory.dmp
memory/5496-0-0x0000000000DA0000-0x0000000000EAF000-memory.dmp
memory/6012-35-0x00000000018F0000-0x00000000018F1000-memory.dmp
memory/6012-49-0x0000000000D20000-0x000000000118A000-memory.dmp
memory/6012-412-0x0000000000D20000-0x000000000118A000-memory.dmp
memory/6012-34-0x0000000000D20000-0x000000000118A000-memory.dmp
memory/6012-6-0x00000000018F0000-0x00000000018F1000-memory.dmp
memory/6012-467-0x0000000000D20000-0x000000000118A000-memory.dmp