d335fa7bdd6410d7d169d4c7786f9f96ee5f45c1e697753f1a0f3c23d4cbfe6f

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 6.7MB
Sample260508-aramdafv7k
SHA256 d335fa7bdd6410d7d169d4c7786f9f96ee5f45c1e697753f1a0f3c23d4cbfe6f
MD5 cbb0cc0141c6141287562216c4410196
SHA1 fa0044b9822fa935eb50ba5e0a7193837876da91
SHA512 dacd14d05255c583fddb3c7d887d5a33d1cd8e6cc521a7616cc2f738515192c144791cc7ce0478870c7dcb2b11e2def630178b76d3cbeaf3257c608cc0ce0b8d
SSDEEP 196608:xvKikd9p2hFvFLODcfyz+Xs+kFhsWE3C7iX9ZlMZQBM/:xvrkd+hXAcvqE3C7OEQ2/
TLSH
T126663394336BA460D969C235D8B1EDFE24E4BF011EE0950A77CC336C66347D2B625B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 12 IoCs

pid	Process
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe
3324	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4856	3324	Setup.exe	79
PID 3324 wrote to memory of 5048	3324	Setup.exe	81

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\system32\cacls.exe
  C:\Windows\sysnative\cacls.exe "C:\Users\Admin\AppData\Roaming\PCDr" /e /p "NT SERVICE\TrustedInstaller:R"
  2⤵
  PID:4856
- C:\Windows\system32\cacls.exe
  C:\Windows\sysnative\cacls.exe "C:\Users\Admin\AppData\Roaming\PCDr" /e /p "BUILTIN\Users:R"
  2⤵
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Common.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\Common.dll
Size 2.3MB
SHA256 722ab4e0c93c89ec03dd24c726d017bf2f1ad792f2440406a01baa548eddb0fd
MD5 401add17502ffbc15f368f6065e9e65a
SHA1 f7ede1716b959cdb0c11736c7f89c5172dc89ac9
SHA512 81aadddbf95f5390f9a71434014a0c9900c8ef667ff440994f16a0cb13eee961c3a2a4fe9a44033cb25e871cf174ded8624351b694d4d08be7d26d257074e560
SSDEEP 49152:7qzFG447JxLrhaxbrpGton+ec09SzuJqdj:k47vL0xPpG6cv
TLSH
T11CB52960B706CA6BD9D272B2883992AB102EBE85CF6095E7C1DC0D6564763C3173FF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Regex.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\Regex.dll
Size 115KB
SHA256 22334bf8c0e6dcb02e51a02a5f0010e0b9673979da23b2229be45b8c07cfcde6
MD5 bbe840abf714f5bb89bab81cdf466838
SHA1 f6005d22ffa9bebcdb09ae87d5ed4798a34f1f8d
SHA512 fb4c3011abc69c103b9ffdf4f20048104e9d698e7981daef5ea28d47e5a3238c194ae007f32f18d9b7ca07277d6ff64648764c5b59be221f8aed5b3d932bb756
SSDEEP 3072:Bh7CcIU7ubeIfJ44CLAT16ieHOp8Yt5ckE:LCcIU7ubfoieHEhc
TLSH
T15FC35B91FA83C1D3CA4B4332492D521A0738F7480F6BCBEFBF545EB92AD22961C25593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Scsi.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\Scsi.dll
Size 71KB
SHA256 4802af3ab305041ab9df088225426f2dfc660ffc3953c4cd7fd918d66ba8535c
MD5 f88597f7d58138de95d6a91c42c8434b
SHA1 0f5bb1edf845ff56db3bb17301c92468c232a16d
SHA512 a86041a446e9fb17fa621ad9ed331cab67c6d6ad5a43f962403624dfdf221721316a11be5eb14c47482565840e12378c8dd77b8323adcd9675f4dca56ae0ae2c
SSDEEP 1536:8g3dfn7Bmgz280d0hTm13Ykt389EX2quMryaQ:8qnt280d0hASqX2quM+aQ
TLSH
T107634A51AA0E60F3F9DB95351979D2AF443DB0500B618DD7E39C0B8A28A9BF3363B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\System.dll
Size 11KB
SHA256 29f4a1c87161643e0ed5c46b46786d9a48437ec5dc6b99f4ff14037429e6e20a
MD5 4cf3a81ab4579b30117c8a39a489d51d
SHA1 61af475e11e4e79e6a11e761fcb540d9c5eec0e9
SHA512 885d131304afbe92b9b0a16830b6b34c6b78e44f972c20aad63cf3695a400f2d82cf217753da2a2e5e399fdd5dd3306a257e9501a86884cad853e01ee125a664
SSDEEP 192:FN2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Jx:6JoiO8V2upW7vQjS/
TLSH
T1E53228328B60C1F2E561C274496B3A3367BA751420B04D6BDFB78446EC16BD66E3E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boost-serialization.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\boost-serialization.dll
Size 266KB
SHA256 330de9c444da0b498e0288bebd2ac4268ad245f9fc85b94621031a6df46a325c
MD5 495abe8ebd3881bc610acec4d5c06601
SHA1 234a43d42d869aa2e9802c4e60c1140c8c93931e
SHA512 7041cd6e2663666f52bab44b2f83cb7f4032945662f760055de15d263930ad28ec76fd3989fa14efbd49ef6b04e6e5fcccddd32195348d7fddbc0d9f063fce88
SSDEEP 6144:FY3Ya0zKqNxSt386Ff4Y55TfZUvixUnTT7FkDPqVwVijkjG6hzWEOc9M7V/VsjzC:FYoa0zmFBiY5Av
TLSH
T19544E924BE458977D8D630B2D825899FA12EBDC1CF15C0D3E2AC0B7958B97C70A36F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\msvcp140.dll
Size 433KB
SHA256 f656f0f98cf2510f4e0fe5d5666643028a6b8bac50bf553c0a464456c0e82934
MD5 a84a8a708751e2cb1f2bb117e9b7f390
SHA1 a9378bae50093465e2ea1567958a1bb656d42149
SHA512 609850f700a3147bbd1947c26ece31aeb0ca70249ec4dcd22f1bdc922fb24b0a20f569de827d4818f32983b65456bc9a9a0e9c23ba1e8eebe8520581a814bc49
SSDEEP 12288:tH0R7WeZbuswwxRek5Y9OehUgiW6QR7t5s03Ooc8dHkC2esgK35d:tH0R6ehx9Hd03Ooc8dHkC2eZK35d
TLSH
T1DB944922BB424DF2E59E13B571C9432257F9FC254760E3C3A3CAF0692F696C26633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\nsExec.dll
Size 6KB
SHA256 8e565626c37c33144d88df65dc4c25ff3aa0eec980b2c3b1e46def3faaf44b74
MD5 6cb1e608b65b83dad598cc5ff10697c6
SHA1 3462038e27a664f58cdc2597640c90f893bd2b1f
SHA512 f269497cb4547668e31b4a75d81bc2948616e5cce9da90ecb9a2cd8870b5a54b5c6b4d4d60d8e70f2b5ef53fce92b7d3da1d2ef15b0097353ca6530b72fec412
SSDEEP 96:M/rspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5Ly39sQvM:M/vUG7lhvov36S5FcUjliSEI5LRQ
TLSH
T18FC1E5B156D909F3E41D00B83E31141F43FEE526077943759E8B2AC62CD2AB6FE18791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcdr-plugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\pcdr-plugin.dll
Size 106KB
SHA256 0601b117aadc027a6dde0d89be0fad5992f73a997ae92b837437f17779068202
MD5 85a44e89139771292138675cf7a28e55
SHA1 bcc03ddfdc41afb54e85f881c981914e35cb20fa
SHA512 50192e1efa01c7d503b2f2a56aacf1adb7a6dd67008b49973c9395aa9bf013d72b1f7dedd71ebf3a0d6b4a7f3a5a241c1048b9ab93f10ba20088f052eb634692
SSDEEP 1536:WVNZe8v6/Afd5/IwI5EPuJK6f3coP7kJVfHLNVJ+wfUm54ANt+b62fOZLS0:C/TOEDIVSUTf2VPLXdp3+62fOZL
TLSH
T1C3B32C253B5F843AEAE2217248398A5F052FB5488F7045DFD39C1A5E1CBABC28D76713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\ucrtbase.dll
Size 900KB
SHA256 c4924c0014d576e5d0678a9ce616d47317e7dbf99ca464ed4f6949f05847d542
MD5 fe0005eb3bb3b40bd407cb003f848079
SHA1 26a99b1de074338f533097c578fb6f1188cc3482
SHA512 8d41a27f9cac80597b6361d2d965eda7d478643b481c5173cb3e2a94e1061545cfda295096ad268d42cb1a69b42165d1fc161c3368c9b13cb9853ec7ea943c9b
SSDEEP 24576:W0qW/eQNMe7KtlQzn4pz+xJlEInEFmcvIZPoy4z1k:P/eoF54pr
TLSH
T19C156A617885C161CCFA21F81AAEF232057EB5944F70A8C737D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa121E.tmp\vcruntime140.dll
Size 83KB
SHA256 5695560a50ed9746696c0d647e55d77459f5981907c177d086df36656a978b19
MD5 b7ebc19a5b23d0d32ff014e30be26061
SHA1 efb3b58b31a27407402a2be0d41aee120519c282
SHA512 922d94e80cdffeb51a1818c52b5c568597307225eed33c7c07e193322c2e9b0c7a5f17f3f4b57f2e22b8ad7f9509cb893bfc6d07d19af83360da6c0d807aa93a
SSDEEP 1536:4jer1DQwLp57xeH8zIJBj3hGzHcL3CTsQ+Vbc8su0sRXdjjecb+4AXmUkEBd:4jeNQwFFxExBozHcL3CTsQ+Vbc/uecbU
TLSH
T153837D11B4C84071D16A4D3452AAEA73763DAA608FD44FDF6FAC4C9C19B93C1773622B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads