001a10b946d41f8794c110f97cd46b961fea0c0d50c92efaef1d166adaffe8b8

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 75.7MB
Sample260426-pcfbmscs5n
SHA256 001a10b946d41f8794c110f97cd46b961fea0c0d50c92efaef1d166adaffe8b8
MD5 c7a1c5c0c8b403a79f658f5247b025f4
SHA1 4742d8622786354fb8f67180270e6c08f5de711e
SHA512 8fa1f0f911f25d8d29c1157c3e58925af4cbb8a4f562396c5a60e8abb351a8348b377d578587cd29620d2d49792b1423eecb5ef0fe4babe351ba6f7676dcec5c
SSDEEP 1572864:j2hT/KfvpEv3LEpGdJM8Y9Hmo0UBPq46PVaZkmmZ3QDh5R1R/W:j2RuQ3LEpIiUQPUgqh9Y3R1c
TLSH
T12F08332BB042C482D85B9EFA9F81D1108FBB5BC03AD79016756EB2BED7710C09E5A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 1 IoCs

pid	Process
3248	pythonw.exe

Loads dropped DLL 14 IoCs

pid	Process
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe
3248	pythonw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pythonw.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3248	1696	setup.exe	85

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\pythonw.exe
  "C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\pythonw.exe" -x "C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\DOC\waiilatpuan.txt"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

waiilatpuan.txt

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\DOC\waiilatpuan.txt
Size 1KB
SHA256 264b5b1e46457a73dc032c53cd503e6b3e0d604dd488fdadf76f5dd66131a319
MD5 ab0386397135384d11882c71e3e91d39
SHA1 21555ba07bd4f17eb15a10a7987317ff0e52a301
SHA512 aac5a265c75fc75ed19c128be94ea3493923b6b2f6f0dbb0d38ddbaf4d24a75609d5f22cb75141f2963319ed3a04bf3f7a066b797090a751ec0bc91c9f537b13
TLSH
T1E7415A715585FDE119BB0EC199242D146C396C7FAF6073B9EEC409C3B2E9100ED2AAE4
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\VCRUNTIME140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\_bz2.pyd
Size 81KB
SHA256 b91468ab572115714a4d0ad15cc7baae046a05b0f49c16fe71c6ebbd0187f88a
MD5 e6e5f044c5be607e75ba43402815f4ed
SHA1 71ee4aa9b8e22c977070cc1feaf190460e052e24
SHA512 0ed8df42d55d7d404dff45e7246ceb606b43c462ed7cf57f8c83d0310213597aa9e7e4cff54f99737ff0927b86eb2292da1d9ea3ba88c2ec1f50f56861965787
SSDEEP 1536:Wc2zR6FP5tbGlA1Q38TkPOlIyLVoiyrcz890fIUYR:IzIFRtSQQsTwOlIyLVJcb
TLSH
T1A5837F80F8C64BDEFF167B3086D5F55BA13C92759B70C9E3E66ABD341A483A76130206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\_hashlib.pyd
Size 53KB
SHA256 bb9b88db8eba3bd3b69a17a2ca434f74b69f8fde65e8ba2d862a40409288367b
MD5 72af4659eac52ec5e0d008ac0c3d1096
SHA1 604ce91d527e48bc7bd496e2895711858bcb14bb
SHA512 b569f0e2a4cce7221317c71a383c5d8ab6f6b94a404d9a9d6929866a862c8d5174769c5cffa06281361fef627b740f9fcded2df879c400156d6bc0a4bd4c5697
SSDEEP 1536:og2GfZ8rq5o5Yj0dUh/9IyvIHjyrcz898sSfIgHwhV:KGh8rq5mUh/9IyvItNsbYIV
TLSH
T18D336C41A4400167EBFB41B476E49F6EA838E65143D871E3FA9B48D11B223E3E736367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\_lzma.pyd
Size 144KB
SHA256 2776b8687788658a1e6745df121bc09ea53a5c308b5da6638eb0e0a8d7d8af48
MD5 290cf4eaaf33a3be0b81b68cbbb5fb92
SHA1 d295aaa7ca9a06fb2721be00dd5d67ebad224a21
SHA512 c2f2832993127de808bbb1bdfd3d975a42b1507fbfffba72b3bb8739413e4d1df4536b9a65c3919a8a48c0be79f78bbf2cde849c08ccd7dea0f564227abd9900
SSDEEP 3072:oGQt8BkJoYng0HFGFH3EDth1Ymb1f5AdC1RHc9cXHf09mNoGQGVlIy0145ZEn:oJv1sEnSm8asYOGtVLEn
TLSH
T136E349A2A506F1E2F2A50C78D2B99F6789FD1548036441D7A1DC1B9C827F7F3A23A743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\_socket.pyd
Size 74KB
SHA256 71821e48a97fc2c1b936d2530593f58542e8bd642120bf1fd8053c2e8e591d3b
MD5 dae513955c02f9a7fc47763476f1ff23
SHA1 c40a8c05185843e2b653f47862a99d6a7c47fbf5
SHA512 b2cac0128889ecc1e1a801276d5f2c5289b05ca0d31c66efca251eb464fc5a90bb1ba544d32d391ece9453a5036647abfab23b97d170bbb9d4d75acd0a0b289c
SSDEEP 1536:+3h44DjjqHcUo5Z1ycMhQlCp+NenzjTn3vesyBx5Iyywqqbxyrcz894fIgHvhQf:+3yyK8R1ycMhQlCp8enzPn3Lkx5Iyywe
TLSH
T1C8734900E1119177F7E10C7075A2DED37E38A7A123A498D36F9B9C95053A6E3FA39392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\_ssl.pyd
Size 158KB
SHA256 cd7a4f1f380570a2b3805fc1ba4eb61f60a451503cbab6e275e890c94e02bc35
MD5 a801cf37d2d98213fc30aa27b8213629
SHA1 b73c177cb88fcc4c806f2c465500cc35969fa2fc
SHA512 8105696440793a68507e9e69686821c0b16e1daebc894952d1ea9824c78caf99fcc388944dead3f6f2ef8dc9eff9535a37ec33cf001ed03e503d81ed339dc2ae
SSDEEP 3072:ixKuyZ2l06PtLGo356SPso6iwDXI2lIyL7zZb0u:ixKuy0lbV56SPLDwFpT
TLSH
T1A5F36D01B52659E3F8DC98F862645357AFA88121F3EE50E349E76CD10A387D36E34B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\libcrypto-3.dll
Size 3.3MB
SHA256 d86d229f944d8a12a19405b95e99a6c5a3fd5ed245ff62470ed91fa613b48add
MD5 4a696daf28f5eaf655d029179cbe0726
SHA1 ae5030c39ee616889ea53af139ee8661d78731e7
SHA512 b65f9741ff1001c636a575886a636cec6002553d3e45cb4c155d0ee05bc4fab617adbc04d2c5cab8213858309652f8d642b0dc630ee7a308b46d6b2cce923720
SSDEEP 49152:QNLkz+QRLxwzIIN8EP/vkFz0o+zx1CPwDvt3uFlDCwK5+3DUvah:4LF7Veyo+F1CPwDvt3uFlDC7
TLSH
T177F59E06FBA36692E8CF827E12EB577F0E391714D72899D38E611899C8355D1733E3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\libssl-3.dll
Size 623KB
SHA256 c1e7bbda0534fb7f15e1fc98a787999d3883fb16e428d264637888cf364f2d31
MD5 b4bb69df25518571a735ffd8ee6b8e4f
SHA1 da49219e8550407aa2c5b7ab79103619d623af08
SHA512 44bf910de17d7d7603777cab17bdc480ed4a7f5469e9460bf445bde230079045aae3992095407658cbd375c009a9cba362119b67d4f05800499d0cbcdeb57cbe
SSDEEP 12288:39bbpr8zEg0Yf108w+5lZg7VdezmFgxmATFe9XbHtXF1:3Fpr/4NmATFe9XbNXF1
TLSH
T102D49EA2A7C24DD1E0C840BA157B17BE1A3E93046724C5D34FA29DA98D61BD6277F3CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\python3.dll
Size 69KB
SHA256 d01dd651d3ced94f05bb8a2185be9929ca7d79126b9e8463e588d7408514efde
MD5 3fb7db5759760e0bcb62af1e357f05d3
SHA1 f1905d39a68dd5757cafe0fbe2e9f5625b3fb402
SHA512 a0faba12ffcae94d6bd87ae29dbdadae5d4ab12b057aae06f5576b75c6ac24f9ffe20ab81185c0421a8a907340bdf64e839da755ba9f6d3e50dfc2bb1c920e47
SSDEEP 768:oQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxij:EotssyKcunV8Py5Iyy06yrcz89spfIb5
TLSH
T14A634CC25B57F8A2D6F665FC78DDD9CD242B02CC97268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313._pth

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\python313._pth
Size 80B
SHA256 35ddf94682ff9aa713a8d63557242ad00f3f28fdd39337f02c3bda4c0f791577
MD5 c23ad35e55e5b1a71ee2e9dd97723749
SHA1 3c5332fcf5e31d3c84fcba3eb722d4c36a1802cf
SHA512 9fd07332911783ff9d534d952eb8cfece7cbeb1934a34da2ab5274d671c38bdbc75e491b3bcac332dd882310c243f389ac6dc7c0eb80e9c0131dff2244e3ad73
TLSH
T140A0220208A30080002020283FC002F88F32330CAB003A0E8BC02E380B00E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\python313.dll
Size 5.2MB
SHA256 268a0f9965809449a4b3012cee22bd1aab23e14a0ef9be27bcc200a680e06427
MD5 18e0b2a3fc302710f680e680d3f89554
SHA1 a401c0d4fbf98c325e5ba74b3235f3bacf126984
SHA512 1940af18f1d529c6cdc0a457e4a219a07abd3bfa4394205829a87707891fdadac7d9379bf1c71594517c0688ec6992c8c2f1db5f63d30f96f02f69380159cbde
SSDEEP 98304:AsjFNMDj/TueuQI0Af1oVatkSoXhalGeH9MwuCqrSmxCd:AyFGTueSY5wUr4
TLSH
T198465C52741BC2E9F9F81879A26A9AB3BD351D04BB6610C395523D2C4EB02F2F37D706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.zip

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\python313.zip
Size 3.6MB
SHA256 a0fd4f3cae391be1256621ae74edf9a5199331803e15abf48b9cd7feeaa235cb
MD5 c5e80e747d917f7259e504e173ad24c8
SHA1 f462ef7e7733e78f320a0a7c29ff2a2e7b170809
SHA512 ac91400d22a022266516fcdf071aa530cacd01e5c4d0ccb317a5a8208f2b2b55d2ec2b5d157fa18627b588d039e9e2efd363221018a69bd6fc60e4fc7f16f776
SSDEEP 98304:0tpH+i23DVj2yvW/QbpeZAJjSiCeCrF9GtH5xtOzfRz:6f2a/cp0wjyeLZ+F
TLSH
T1C7063322CD7E9D57FF5BF6315C30DA0AAD8E43946280A95F3D0D80A4AE535F51B2E02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\pythonw.exe
Size 99KB
SHA256 7cfef058b1055b3f778456a2879739db198bd0a57b35db4840fac077893c38b0
MD5 5fc767ed2c6a904729762f64e504bd0a
SHA1 986b9535020dc0f2436b7ebe8081be1ee857aa8e
SHA512 ca9d18726208341756b4891b8a9dd7c0963283d8718cfa1ff4c45bdc4db9fcd4e4ccee341576d848208617262880240b6c17a93e92050e8f5cb0d64a4722b0a3
SSDEEP 1536:MExhIxHHWMpdPa5wiE21M8kJIGFvb1Cwj//0sGsyrcz89cfI38VM0dn:RSwMpdCq/IM8uIGfR//0sBSIln
TLSH
T1A0A3F741E62CBDCDE548D5314A75E4F25E28ED327580A11EB7F3BF062835293F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\select.pyd
Size 28KB
SHA256 6dda8cccd23d1749369702c302d5ab990cf07e63b1c944b93725fed574302e15
MD5 ae900d9981d51eacba144c1e6bd92aad
SHA1 820281dfb76aaec7d27afea37552857dea083bf2
SHA512 5ddfbe59cda60c705354238c92423a0fd608c5c9fb11cfa7fdde1696370b30e7428b2677fb57bafa8e02d4337c7ab3d52811c558fd96e449fc179360ddd5ca51
SSDEEP 768:qjqf/Wnfz/CY2rR5Iy9GAgXyrcEOJh2Ip47Cxf1ml0ZMn:qemfWVR5Iy9Gnyrcz89UfIbn
TLSH
T1ABD28D869A1440B3EDD22AB056B5CE93FD3CABA30C95895235EBD1440E737C1FF26279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\4352947d-d7d9-40be-92ff-31646163f6e1\TEMP\unicodedata.pyd
Size 686KB
SHA256 e6fe4143ba09257774e8a483c32cd35ef4e02abcbb7107ad531164771441c94d
MD5 340ee703260ded9364be3cec7facdca8
SHA1 6c70c437a34a869c0a7a44917082a4ba0851f392
SHA512 3f9d90f3dd8250d3843a14f57dabedfd75b94432fb8485f66e48e255be4323387c3c94367535a6ac8d116cab245ac9852d649f102016ed238058053468fef9fd
SSDEEP 12288:DvNdLI/X77mvfldCKEMihH32W3cnPSqrUNUe:DvNW7qNxEd3cnPqUe
TLSH
T19BE4F5D5BBCF8D26E68B363A48E3710F5171C3B35F1A8636B6182361D85B3B449D182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-120-0x00000000008A0000-0x00000000008DB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads