Analysis
- user interaction
yes - max time kernel
54s - max time network
35s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
02/05/2026, 12:35
General
- Target Setup.exe
- Size 11.7MB
- Sample260502-psfmcabv7p
- SHA256 82a3ba5caa5b2485aae01a593f7ab4a3068d6b7ca367743fff8c6f0e8e81ae69
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4828-0-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-4-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-15-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-11-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-9-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-7-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-6-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-23-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-844-0x0000000077B22000-0x0000000077B23000-memory.dmp
memory/4828-1743-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-1966-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1982-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1981-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1959-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1943-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1940-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1933-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1926-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1919-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1912-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1904-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1897-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1890-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1876-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1869-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1862-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1855-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1848-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1841-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1834-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1827-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1820-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1806-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1799-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1785-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1778-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1771-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1764-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1757-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-1755-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1752-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-1749-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-1746-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-1744-0x000000007F5B0000-0x000000007F5B1000-memory.dmp
memory/4828-1973-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1813-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1792-0x00000000008B0000-0x0000000000922000-memory.dmp
memory/4828-1987-0x000000007F700000-0x000000007F74A000-memory.dmp
memory/4828-2000-0x000000007F760000-0x000000007F761000-memory.dmp
memory/4828-2002-0x0000000000BE0000-0x0000000000C30000-memory.dmp
memory/4828-2001-0x0000000000600000-0x0000000000603000-memory.dmp