eb9cd9b17479dbf69bd96f9dfe440b46df29a8b5dde7997e5c3da3fea7946827

Resubmissions

23/04/2026, 18:08

260423-wq9kzac16p7

23/04/2026, 14:08

260423-rfva3sew2k7

Analysis

user interaction
yes
max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medtrans-setup-1.6.6.2.exe
Size 4.7MB
Sample260423-rfva3sew2k
SHA256 eb9cd9b17479dbf69bd96f9dfe440b46df29a8b5dde7997e5c3da3fea7946827
MD5 a44ce0777e19e0b7689c8abc5bedb7da
SHA1 bac8248f0b842fcab372d0d7fecbf40488ad1b7e
SHA512 3a7edd42e8721c056fc0b1a712f21ecb736ef847796c5f22ed2fd09e39d3e2eba7933c5a3ed01af51d07edaa4d9c53cf2b3f1003ef835922f759bc208699cda8
SSDEEP 98304:7J+stMSHhhe6HLWSK6kTdZh1EDFHoTP236K85h/qvizq:t+kMog6pKrt1+HobW6VCv6
TLSH
T1873633493E59C5A2FA3AFA751D79DE75E162242939058CC2B0FDFA8D38C14F0983E1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery link pdf persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
900	shelllink.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Create_Icon = "c:\\medtrans\\shelllink.exe c:\\medtrans\\medtrans.bat c:\\medtrans\\medtrans.ico"	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\SET244A.tmp	rundll32.exe
File created	C:\Windows\INF\SET244A.tmp	rundll32.exe
File opened for modification	C:\Windows\INF\medtrans.INF	rundll32.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x001900000002b330-41.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shelllink.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	medtrans-setup-1.6.6.2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1736	4972	medtrans-setup-1.6.6.2.exe	80
PID 1736 wrote to memory of 2680	1736	rundll32.exe	81
PID 2680 wrote to memory of 900	2680	runonce.exe	84
PID 2680 wrote to memory of 4452	2680	runonce.exe	87

C:\Users\Admin\AppData\Local\Temp\medtrans-setup-1.6.6.2.exe
"C:\Users\Admin\AppData\Local\Temp\medtrans-setup-1.6.6.2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\MEDTRANS.INF
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\medtrans\shelllink.exe
      "C:\medtrans\shelllink.exe" c:\medtrans\medtrans.bat c:\medtrans\medtrans.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:900
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452

C:\Windows\system32\grpconv.exe
grpconv -o
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MEDTRANS.INF

Path C:\Users\Admin\AppData\Local\Temp\MEDTRANS.INF
Size 3KB
SHA256 02f63b9aa08ff80b2e5152e2cbc525683b65f6b44c0363c631f641095a5ec5c9
MD5 f987bfda403abf994b276ce685fe4337
SHA1 8bf5cb7e8963a4a583dda3e164c0332273091f6c
SHA512 2938fce7b6803ceeb6d128df728efd8b0fb9bfc6396ac3155d1357a0f43953d4dcf67bc4c9a469cf889c1459afa32a2922dcb5985cb2d4cee7884a0dc95fe906
TLSH
T10D61428A2D008B2370E2F59E97C73A07CB2E8B6D6254838DF269C051D91160D627F7F2
MD5 SHA1 SHA512 TLSH

Submit Download

medtrans.cab

Path C:\Users\Admin\AppData\Local\Temp\medtrans.cab
Size 4.7MB
SHA256 fc5e3f4c025ef46067a5b886580b656295645b86d19726f9b22294a568288f8f
MD5 288687b8a7ef1ceb3e56aa23a57e84d9
SHA1 f2d84db71ac3c0f8c4c053036cb0762ce02a4707
SHA512 e811c93b5a5554dc6f62f1486c05badcc2fd3039f1f1ad39e9d4b30cc5bc0e99116cb3ae6ea38f1055d6c0f879ba309f7e68ef963dc7a6915b066416ef30197a
SSDEEP 98304:4J+stMSHhhe6HLWSK6kTdZh1EDFHoTP236K85h/qvizqK:g+kMog6pKrt1+HobW6VCv6X
TLSH
T1BB3633493E5DC5A6BA3AFA455D79DE792162242939098CC2B0FDFECC38C54F0983E1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET2390.tmp

Path C:\medtrans\SET2390.tmp
Size 2.2MB
SHA256 a35c705ecc32e606f196834c5dafbd0ff91482b0138a2da85af7f27eeb4256eb
MD5 60563340a72cd85fd1e6d76fdfbfd94d
SHA1 5dfc0b47ebfe9ad3ad08bc23d70c6edf8a12dac3
SHA512 6a19073f135dd56a7cdb575cfecc5c5cc7067a54035691178082029a6e58be5d3a7cb5bfd19d0c98f19a16dee80ed1401ba74645c5749d254bf82f316f91b8a5
SSDEEP 49152:rv9zbUVAM1rKnTAdqv/EqHxMnQo8e1TbyaPKYcSpSk:rv9zbU3ZKnTzvgN8X
TLSH
T1A1B5AE12B6818076E5D20574D56AABBE4979BE30072554D3F7CC3F2E8F302D26B3A74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET23B2.tmp

Path C:\medtrans\SET23B2.tmp
Size 2KB
SHA256 1628598d9afb59c60175e13894e9555d69c1cba325aab578319496671d3f5a8c
MD5 0c08b544fd2a110653c2b515146c3bf7
SHA1 c2c56a6fc8072703dd564032ef2d6f5731f8ae14
SHA512 d24bbd5203750f34f20bbe5e6209990768f1618d5ae2bd902b5f1c8ecc19d080a91de465ee9a20ba2af77f7d8ff937c0fc0822997bf52400c0a0f5d5431e25f7
TLSH
T15941DE7BA35BC4D4C40184B0D95B95989B7A1E32642500DA4D72BFBF5FFBE21A21EC22
MD5 SHA1 SHA512 TLSH

Submit Download

SET23B4.tmp

Path C:\medtrans\SET23B4.tmp
Size 40KB
SHA256 33a3aa05e2ada8c33441b59d16cb0bb1a21743114a4c3f109d6a754ce5cbe111
MD5 12ee3f4da6382db2c25a7bcce6f96677
SHA1 6f4833508e5e2153c70576fccf6c2b8be1384372
SHA512 cf7e90c113503778ceccd1a681700e54479c126548fa8b1332473cb73ba31f7b1f5f35f6f950dd1f679af8dc547494d5bbf65777f1a2337b25b21690a392fd91
SSDEEP 384:Q3Tw0SMBQPHCpYBpCticvwonN2U/fIcbyN9/reAGoR:Cw0vQPHYYBQjNge+jeVo
TLSH
T1FC037C2778E24573D481C6B061B2CF6EA33F563207A69587CB04AC5A3E715F0EA3A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET23B6.tmp

Path C:\medtrans\SET23B6.tmp
Size 45B
SHA256 456192ef343c3dee72c1c88dc735fc95430e8ba74e993719f5a5c2a7d5df989a
MD5 4b917c9d683382e5df8153631ef88186
SHA1 a327b156935db7aef0eb4f3af353c3e3b81375a1
SHA512 907b997bbf8b43aa2b7a4c02bbe7aae94fb452bf9b60562cc539dd90881537e046a4aedb64aef517798dcdb8bf40dd5902bd7404e34eac451f975986be4ec5be
MD5 SHA1 SHA512

Submit Download

SET23B8.tmp

Path C:\medtrans\SET23B8.tmp
Size 1.1MB
SHA256 d1961cca7a2a0e0d9d7083d57fbcb57b152917f41ae42b7b5e6770247b00a8f9
MD5 22a99865f5dda92d174c3ed432c38f45
SHA1 0c607e09e8620813091d1b709917c0b5133476f0
SHA512 88e1c3981fa4ab85cc6267d919d906645401160eb7cbaba31f761c1fb65dbd8694ebaa89e3d7806d45abb2b06095da3ebbc2c28224f09a74680ed628f443d069
SSDEEP 24576:NQvpleUkLQn2zbbxZJCyyikWvsCSPRg+oNhX8ss1O:2LehQn2zbbxjCyynOjQRz2hTSO
TLSH
T10345011348586DCFD29447A5BF0F3D557B49B622F6C16AEA322ECFC62740A379C1702A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET23D9.tmp

Path C:\medtrans\SET23D9.tmp
Size 7B
SHA256 1433fd6a7e9050dd40925c4dfd3cea00624ed6570dc940307161215d809b2eed
MD5 0a9082478b1a1466f6e56fd5e48db8c4
SHA1 81155ff1887266b24ea1b1ad1c557e3de298bf42
SHA512 acf384443beb98943c838ccbd05fdaabe380123cf52126b4f93d0ed0f1798f93287bcdb46cc36428c90430a9e60932b54f66a50d5c01f7bc8eb38d0acf89253c
MD5 SHA1 SHA512

Submit Download

SET23DB.tmp

Path C:\medtrans\SET23DB.tmp
Size 5.0MB
SHA256 229ee5b067b475804889919554247698681042dfb02e3cfb9c098675348e2c28
MD5 4a4b29c76ad468c2f4b14a9f98addfdd
SHA1 a6f0c7257ee6a72702691bb17aa68dc8b1163363
SHA512 7547016aa8fe40b4116614d38a9ea688dfa195fb320e56e044743a46739988a8e5544fda0a5b3307f1e1fc1bcc79680443b618d07a3784fc5f139044b34e923b
SSDEEP 98304:wgY2mvLHig4GeMIcCK3Md45sYAtjeTyX63FRiimCHC7TNhipnnsg09snWh5izS0Z:jVmjChGeMIcF4i4NhipAbizS0g3Pa/46
TLSH
T1A9369D01D0726121C5427073FC1EF7794B206E390BF54AEBB6D4ACE3AB749E2763A652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-69-0x0000000000980000-0x0000000000ACD000-memory.dmp

Download

memory/2680-72-0x0000000000D70000-0x0000000001372000-memory.dmp

Download

memory/4452-70-0x0000000000B80000-0x0000000001182000-memory.dmp

Download

memory/4972-64-0x0000000001700000-0x0000000001D02000-memory.dmp

Download

memory/4972-73-0x0000000001700000-0x0000000001D02000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads