Overview

overview

7

Static

static

3

evo-x2-coo....6.exe

windows10-2004-x64

7

evo-x2-coo....6.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    evo-x2-cool-setup-0.6.6.exe
  • Size 5.0MB
  • Sample261104-weshbattbt
  • SHA256 ea75ff110d4e515638b7cd4945a8b0dccbe328621ff47e78d954d0fbd54d591d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.6.exe
    "C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.6.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Local\Temp\is-UATM27T2X4.tmp\evo-x2-cool-setup-0.6.6.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UATM27T2X4.tmp\evo-x2-cool-setup-0.6.6.tmp" /SL5="$5025C,3993985,848384,C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.6.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /im evo-x2-cool-front.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
      • C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\evo-x2-cool.exe
        "C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\evo-x2-cool.exe" --entfernen
        3⤵
        • Executes dropped EXE
        PID:2608
      • C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\evo-x2-cool.exe
        "C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\evo-x2-cool.exe" --stopp
        3⤵
        • Executes dropped EXE
        PID:1404
      • C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\PawnIO_setup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\PawnIO_setup.exe" -install
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3124
      • C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
        "C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --installieren
        3⤵
        • Executes dropped EXE
        PID:1860
      • C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
        "C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2220
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ae39e9cb-dfb5-f645-ac18-2d7ab76dda29}\pawnio.inf" "9" "4c553107b" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "c:\windows\temp\pawnio_f0b763e4.tmp"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2036
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000154"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2892
  • C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --dienst
    1⤵
    • Executes dropped EXE
    PID:4108

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        evo-x2-cool-front.exe
        • Path C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
        • Size 77KB
        • SHA256 077d0f814721d32148de12116528b8996f2a86f2a0d35c9c6a9ee289f9bc5394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AMDFamily17.bin
        • Path C:\Program Files\EVO-X2-COOL\pawnio\AMDFamily17.bin
        • Size 10KB
        • SHA256 dae74615761b78bdf064dfb3e136252ddcc6fc727d88f14738d0e5800d427a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LpcACPIEC.bin
        • Path C:\Program Files\EVO-X2-COOL\pawnio\LpcACPIEC.bin
        • Size 2KB
        • SHA256 c38fd116e7aff4d1fdb0a494e296be0a6708e5a22fc72f14587442fb7f8f7906
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sprache-de.ini
        • Path C:\Program Files\EVO-X2-COOL\sprache-de.ini
        • Size 10KB
        • SHA256 56f2d126408bad64807b1db71ce7b4a8a66ad47df585935014d02d594b884827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        einstellungen.ini
        • Path C:\ProgramData\evo-x2-cool\einstellungen.ini
        • Size 553B
        • SHA256 f2ecd5c8923a00ed54757134b6b280ef210f815736f22fd62ed2794df077bf5f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        einstellungen.ini
        • Path C:\ProgramData\evo-x2-cool\einstellungen.ini
        • Size 575B
        • SHA256 91748c18d940736bf41e010d6a37ecbc24db5f386fc99480f4727d734c1bb62b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        evo-x2-cool-setup-0.6.6.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-UATM27T2X4.tmp\evo-x2-cool-setup-0.6.6.tmp
        • Size 4.1MB
        • SHA256 7fc1c3f28c4f0d651975eceec4d06e7f2520576430a2906074c834e59cbc3592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PawnIO_setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\PawnIO_setup.exe
        • Size 3.3MB
        • SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        evo-x2-cool.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-XK8MW2MJ4F.tmp\evo-x2-cool.exe
        • Size 62KB
        • SHA256 2fdab8f40ed60afcae004f107642d0191997eee0c40b64e8d37fb6478ba207d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pawnio.cat
        • Path C:\Windows\Temp\PAWNIO~1.TMP\pawnio.cat
        • Size 11KB
        • SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PawnIO.inf
        • Path C:\Windows\Temp\PawnIO_F0B763E4.tmp\PawnIO.inf
        • Size 1KB
        • SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PawnIO.sys
        • Path C:\Windows\Temp\PawnIO_F0B763E4.tmp\PawnIO.sys
        • Size 133KB
        • SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3436-0-0x00000000009A0000-0x0000000000A7E000-memory.dmp
        Download

        memory/3436-207-0x00000000009A0000-0x0000000000A7E000-memory.dmp
        Download

        memory/3436-7-0x00000000009A0000-0x0000000000A7E000-memory.dmp
        Download

        memory/4484-8-0x0000000000CB0000-0x00000000010E9000-memory.dmp
        Download

        memory/4484-64-0x0000000000CB0000-0x00000000010E9000-memory.dmp
        Download

        memory/4484-11-0x0000000000CB0000-0x00000000010E9000-memory.dmp
        Download

        memory/4484-206-0x0000000000CB0000-0x00000000010E9000-memory.dmp
        Download

        memory/4484-9-0x0000000001470000-0x0000000001471000-memory.dmp
        Download

        memory/4484-5-0x0000000001470000-0x0000000001471000-memory.dmp
        Download