dc6cbd83d58482883ba0d1e70b88d0d89c756f4c8a2bcd2f24778c326cbc4c33

Resubmissions

11/05/2026, 14:16

260511-rllacsb1718

11/05/2026, 13:31

260511-qssscabs2s8

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SAP-GUI-770/SapNwBcSetup.exe
Size 280KB
Sample260511-rllacsb171
SHA256 dc6cbd83d58482883ba0d1e70b88d0d89c756f4c8a2bcd2f24778c326cbc4c33
MD5 9854d36b53d21af044c825be7325f2bd
SHA1 2db9e0cbea9a4350faa594d59b64eaab78d3fc6a
SHA512 157abf48557f25eda24e6dadb6bda4a2cbcfb159b4c7278bede40228247e81aadf385c2f479df6a165ee3be461b88d3e0846e637b8ae999292b5f7a4fddf74af
SSDEEP 3072:xgTBCJ/cm9jAJ5YouKG9SZrS0LbDYPm9rnNrqfA1amHuAg0FuzmGql4qRFGU2rdS:xuCx+6o1GcZr/vYPIbNjeAOzElFJus
TLSH
T190546C207992C436D573063109F8DBB6567EBD140F608EDF93C82F2E9E342D26A31E66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SAP\SapSetup\LOGs\NwSapSetup.log	NwSapSetup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SapNwBcSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NwSapSetup.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU	NwSapSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (Microsoft Hypervisor with SLAT support detected)\""	NwSapSetup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe
6124	NwSapSetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 6124	5172	SapNwBcSetup.exe	78

C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\SapNwBcSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\SapNwBcSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\Setup\NwSapSetup.exe
  C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\Setup\NwSapSetup.exe /product:"NWBC770" /noRestart /TitleComponent=NWBC770
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6124-2-0x0000000000C40000-0x0000000000CA4000-memory.dmp

Download