Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/11/2026, 21:49
Behavioral task
behavioral1
Sample
AppLinkInsights-0.10.0-x64-Setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target AppLinkInsights-0.10.0-x64-Setup.exe
- Size 2.3MB
- Sample261101-1psy2sdv3s
- SHA256 4d568ac52206f23ddfa50a4ba728e069806fdd10ddea1f3cbc957e1df5130730
- MD5 6c3f02464790ca7e2f8d4b4dc8398b33
- SHA1 36eafbd6d4626d09a9c83e7a349e6886151c499e
- SHA512 f22daeba1d26f928dc10f287ceede8a5435af9787151aa7404a4376f56ef2ac41547987025683d71109b53c7a246a892001ecd82e04462cbde87da100d202c50
- SSDEEP 49152:0AX7NMIzmPF5OvXSQ2alVgSLRfHSUW4YYKOTX:0AX7FgMXIalVr9y90z
- TLSH T101B5E133B28A753EE06E4A3A5973E610543B7761AD178D1AD6F4086CCF291A03E3B747
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 616 AppLinkInsights-0.10.0-x64-Setup.tmp 2608 AppLinkInsights.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLinkInsights-0.10.0-x64-Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLinkInsights-0.10.0-x64-Setup.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/5856-0-0x00000000001C0000-0x000000000029D000-memory.dmp innosetup behavioral2/memory/5856-7-0x00000000001C0000-0x000000000029D000-memory.dmp innosetup behavioral2/memory/5856-46-0x00000000001C0000-0x000000000029D000-memory.dmp innosetup - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 616 AppLinkInsights-0.10.0-x64-Setup.tmp 616 AppLinkInsights-0.10.0-x64-Setup.tmp 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 616 AppLinkInsights-0.10.0-x64-Setup.tmp 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe 2608 AppLinkInsights.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5856 wrote to memory of 616 5856 AppLinkInsights-0.10.0-x64-Setup.exe 89 PID 616 wrote to memory of 2608 616 AppLinkInsights-0.10.0-x64-Setup.tmp 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\AppLinkInsights-0.10.0-x64-Setup.exe"C:\Users\Admin\AppData\Local\Temp\AppLinkInsights-0.10.0-x64-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\is-ZFEGZC3R4D.tmp\AppLinkInsights-0.10.0-x64-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ZFEGZC3R4D.tmp\AppLinkInsights-0.10.0-x64-Setup.tmp" /SL5="$D0224,1185668,844800,C:\Users\Admin\AppData\Local\Temp\AppLinkInsights-0.10.0-x64-Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Programs\App Link Insights\AppLinkInsights.exe"C:\Users\Admin\AppData\Local\Programs\App Link Insights\AppLinkInsights.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2608
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Programs\App Link Insights\AppLinkInsights.exe
- Size 697KB
- SHA256 993d28f1f10aac93cc5ce52ef3d1f9c7170fbbcdfd725566c4c5a260286e2ccb
- MD5 9daa6f568ffaadbece0fd22ac93844d6
- SHA1 555d4dd0072824047b3a45a0d131c4d530a20d6b
- SHA512 908279adbb0e72c7c435b495fcdba60e385f5e5148a91d333c678fe8988f0b42494b2ff03afe1867fd024a9748288ad6eaa50f4c73d8df6037ae4d40c7db7778
- SSDEEP 12288:RDQW9BNPWGT8lDXy3bYvQFIfIscSaBgRtBYyeSph0lhSMXl+AEDc4MKkah:R7NPWG4JCI+Bg1Nfh0lhSMXluDc4Mqh
- TLSH T1A0E49033E6A850FCD077C1BA8A974D06F7B7784903715ADB03909AA21F23AD55E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-ZFEGZC3R4D.tmp\AppLinkInsights-0.10.0-x64-Setup.tmp
- Size 4.2MB
- SHA256 d600bdc38cb78148b791753099428e2d5f5ccd478a0b9e505c127c6331bf9806
- MD5 330f561f4b19797d03ff84b5615bc275
- SHA1 d8ef26f630ccba85dc5b04ceab44080a128272d5
- SHA512 780f9a1624fe890275e4eca7018997b58ca2200b77e5362de3e6eb3ad014a3b81792c14d2f7a3fc3c9a26797adacd8c776baa21551268cb3f48c7074820eb084
- SSDEEP 49152:MoPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lOF333JQg:Mgw26xBij3QG+ddr9/OzGbRw6333l
- TLSH T1A0166C13B388653EE46B1A3B483BA658583F7B313A168C577BE40D4D4E396407E2A7C7
- MD5 SHA1 SHA512 SSDEEP TLSH