Overview

overview

7

Static

static

3

evo-x2-coo....3.exe

windows10-2004-x64

7

evo-x2-coo....3.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    evo-x2-cool-setup-0.6.3.exe
  • Size 5.0MB
  • Sample261104-wezavset6m
  • SHA256 8633b94d7e5e663d8fef70dac575be326db9aeabefc9a5b75ed3953d07e05883
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.3.exe
    "C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Local\Temp\is-WX98M75T59.tmp\evo-x2-cool-setup-0.6.3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-WX98M75T59.tmp\evo-x2-cool-setup-0.6.3.tmp" /SL5="$90042,3991941,848384,C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.3.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3280
      • C:\Windows\system32\taskkill.exe
        "C:\Windows\system32\taskkill.exe" /im evo-x2-cool-front.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:8
      • C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\evo-x2-cool.exe
        "C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\evo-x2-cool.exe" --entfernen
        3⤵
        • Executes dropped EXE
        PID:1316
      • C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\evo-x2-cool.exe
        "C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\evo-x2-cool.exe" --stopp
        3⤵
        • Executes dropped EXE
        PID:3812
      • C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\PawnIO_setup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\PawnIO_setup.exe" -install
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1276
      • C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
        "C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --installieren
        3⤵
        • Executes dropped EXE
        PID:1920
      • C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
        "C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:736
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{10d0b2de-4401-d647-9e2d-2b3c9a30cee8}\pawnio.inf" "9" "4c553107b" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\windows\temp\pawnio_138cd36d.tmp"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3068
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000148"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4276
  • C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --dienst
    1⤵
    • Executes dropped EXE
    PID:1388

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        evo-x2-cool-front.exe
        • Path C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
        • Size 77KB
        • SHA256 a5a28519b452b54313af71e166c24950e348532f2c68cc147f79318f32f8233b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AMDFamily17.bin
        • Path C:\Program Files\EVO-X2-COOL\pawnio\AMDFamily17.bin
        • Size 10KB
        • SHA256 dae74615761b78bdf064dfb3e136252ddcc6fc727d88f14738d0e5800d427a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LpcACPIEC.bin
        • Path C:\Program Files\EVO-X2-COOL\pawnio\LpcACPIEC.bin
        • Size 2KB
        • SHA256 c38fd116e7aff4d1fdb0a494e296be0a6708e5a22fc72f14587442fb7f8f7906
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sprache-de.ini
        • Path C:\Program Files\EVO-X2-COOL\sprache-de.ini
        • Size 10KB
        • SHA256 2c3a763a9071a0a45447e5e42c83a7dbce5b26f2bac51283f656c5e9b614b0ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        einstellungen.ini
        • Path C:\ProgramData\evo-x2-cool\einstellungen.ini
        • Size 521B
        • SHA256 38315bb8cbf2373fa3f8db028daa55d2f7158af9fbedfeae2e02268af9f0f2c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        einstellungen.ini
        • Path C:\ProgramData\evo-x2-cool\einstellungen.ini
        • Size 543B
        • SHA256 297c96dd1004e997dff4ec66fdc8f2c736dfa048fddead24421c0bbadb3f793e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PawnIO_setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\PawnIO_setup.exe
        • Size 3.3MB
        • SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        evo-x2-cool.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-IY6INWXUSC.tmp\evo-x2-cool.exe
        • Size 61KB
        • SHA256 fa0a7b1de00a8edccd2f3fdce4344a9cf5771761b82ef64187558dfd33dd33f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        evo-x2-cool-setup-0.6.3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-WX98M75T59.tmp\evo-x2-cool-setup-0.6.3.tmp
        • Size 4.1MB
        • SHA256 c0d7579742bfb90140a2820d22cc26a55abe1724e221000b4f130609052f30a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pawnio.cat
        • Path C:\Windows\Temp\PAWNIO~1.TMP\pawnio.cat
        • Size 11KB
        • SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PawnIO.inf
        • Path C:\Windows\Temp\PawnIO_138CD36D.tmp\PawnIO.inf
        • Size 1KB
        • SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PawnIO.sys
        • Path C:\Windows\Temp\PawnIO_138CD36D.tmp\PawnIO.sys
        • Size 133KB
        • SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3280-8-0x0000000000F70000-0x00000000013A9000-memory.dmp
        Download

        memory/3280-64-0x0000000000F70000-0x00000000013A9000-memory.dmp
        Download

        memory/3280-11-0x0000000000F70000-0x00000000013A9000-memory.dmp
        Download

        memory/3280-9-0x0000000001840000-0x0000000001841000-memory.dmp
        Download

        memory/3280-204-0x0000000000F70000-0x00000000013A9000-memory.dmp
        Download

        memory/3280-5-0x0000000001840000-0x0000000001841000-memory.dmp
        Download

        memory/3608-0-0x00000000002A0000-0x000000000037E000-memory.dmp
        Download

        memory/3608-7-0x00000000002A0000-0x000000000037E000-memory.dmp
        Download

        memory/3608-205-0x00000000002A0000-0x000000000037E000-memory.dmp
        Download