0eb5733fa6f3d056aba57b3303495d15dc71a9656d489dac3aed1c53f28ce964

Analysis

user interaction
yes
max time kernel
20s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup (1).exe
Size 82.5MB
Sample260425-sebysadx7r
SHA256 0eb5733fa6f3d056aba57b3303495d15dc71a9656d489dac3aed1c53f28ce964
MD5 75fb90733b049b01ef5e18b7b9287c6e
SHA1 893af8bfb6a405e90ef9718c449850f994ffd686
SHA512 903d4684c89f190dbe329dd599eec36ad6e730bb671aa7c9caeb2ee3ad9dcdc6b2d01f63285ff4893950385e2fed6154fbe61ee32d0ccbb7485d67a60d290da2
SSDEEP 1572864:c9tM33FA7xlrO0+DSaWy7QP0IkOe054xOuty95dI1uh6ibqF2:c9th7xl6sKQswf54Nyrd8uh6iuF
TLSH
T1D51833A7D5F2A8F1D0988C31A9399143F5364E78D77EAF070122807B8FA3E581E15B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 5424	1260	setup (1).exe	80

C:\Users\Admin\AppData\Local\Temp\setup (1).exe
"C:\Users\Admin\AppData\Local\Temp\setup (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SYSTEM32\tar.exe
  tar.exe -xf "C:\Users\Admin\AppData\Local\Temp\melancholy_payload.zip" -C "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BodyPosition.png

Path C:\Users\Admin\AppData\Local\Temp\GameBarPresenceWriter\BodyPosition.png
Size 547B
SHA256 6e89455cf8b0a5967a3020931e0a1e3845d2280d0e250e3dbc04c798816528c8
MD5 0a803d379058e2e2318411f936b92d83
SHA1 49952663dbbe858ba572117741c836d4b9fd28da
SHA512 4b843b97df97ee967575a9271d6bb910adec769667394560e8052e0fcdccea65fced742d98f926dd7d03931182bfbb2e54c46fe209d8cbb8f67e62a6aec0347c
TLSH
T144F096D2828988897E5C11BF4D25382FAC32066D86E1DC040431F50012B29D446953CE
MD5 SHA1 SHA512 TLSH

Submit Download