Resubmissions
11/05/2026, 17:21
260511-vxfe2afw5z511/05/2026, 17:10
260511-vpp99say4m511/05/2026, 16:45
260511-t9cz1aez6s5Analysis
- user interaction
yes - max time kernel
298s - max time network
277s - platform
windows10-2004_x64 - resource
win10v2004-20250619-es - resource tags
- submitted
11/05/2026, 17:10
General
- Target Setup.exe
- Size 1009KB
- Sample260511-vpp99say4m
- SHA256 a0706de5c6c1b2845c0730135628e05bfcf536fea5f7c64d3681ce289cfa410f
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4124-0-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-1-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-4-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-6-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-7-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-9-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-11-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-15-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-23-0x00000000FF950000-0x00000000FF951000-memory.dmp
memory/4124-1196-0x00000000FFAE0000-0x00000000FFAE5000-memory.dmp
memory/4124-1202-0x0000000003100000-0x0000000003101000-memory.dmp
memory/4124-1201-0x0000000003100000-0x0000000003101000-memory.dmp
memory/4124-1203-0x0000000003110000-0x0000000003111000-memory.dmp
memory/4124-1204-0x0000000003110000-0x0000000003111000-memory.dmp
memory/4124-1206-0x0000000003120000-0x0000000003121000-memory.dmp
memory/4124-1205-0x0000000003120000-0x0000000003121000-memory.dmp
memory/4124-1208-0x0000000003130000-0x0000000003131000-memory.dmp
memory/4124-1209-0x0000000003150000-0x0000000003151000-memory.dmp
memory/4124-1211-0x0000000003160000-0x0000000003161000-memory.dmp
memory/4124-1210-0x0000000003150000-0x0000000003151000-memory.dmp
memory/4124-1207-0x0000000003130000-0x0000000003131000-memory.dmp
memory/4124-1212-0x0000000003160000-0x0000000003161000-memory.dmp
memory/4124-1214-0x0000000003170000-0x0000000003171000-memory.dmp
memory/4124-1213-0x0000000003170000-0x0000000003171000-memory.dmp
memory/4124-1216-0x0000000003180000-0x0000000003181000-memory.dmp
memory/4124-1215-0x0000000003180000-0x0000000003181000-memory.dmp
memory/4124-1217-0x0000000003190000-0x0000000003191000-memory.dmp
memory/4124-1218-0x0000000003190000-0x0000000003191000-memory.dmp
memory/4124-1220-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/4124-1219-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/4124-1222-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/4124-1221-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/4124-1224-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/4124-1223-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/4124-1226-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/4124-1225-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/4124-1228-0x00000000031E0000-0x00000000031E1000-memory.dmp
memory/4124-1227-0x00000000031E0000-0x00000000031E1000-memory.dmp
memory/4124-1230-0x00000000031F0000-0x00000000031F1000-memory.dmp
memory/4124-1229-0x00000000031F0000-0x00000000031F1000-memory.dmp
memory/4124-1232-0x0000000003200000-0x0000000003201000-memory.dmp
memory/4124-1231-0x0000000003200000-0x0000000003201000-memory.dmp
memory/4124-1234-0x0000000003210000-0x0000000003211000-memory.dmp
memory/4124-1233-0x0000000003210000-0x0000000003211000-memory.dmp
memory/4124-1236-0x0000000003220000-0x0000000003221000-memory.dmp
memory/4124-1235-0x0000000003220000-0x0000000003221000-memory.dmp
memory/4124-1238-0x0000000003230000-0x0000000003231000-memory.dmp
memory/4124-1237-0x0000000003230000-0x0000000003231000-memory.dmp
memory/4124-1239-0x0000000003240000-0x0000000003241000-memory.dmp
memory/4124-1240-0x0000000003240000-0x0000000003241000-memory.dmp
memory/4124-1242-0x0000000003250000-0x0000000003251000-memory.dmp
memory/4124-1241-0x0000000003250000-0x0000000003251000-memory.dmp
memory/4124-1244-0x0000000003260000-0x0000000003261000-memory.dmp
memory/4124-1243-0x0000000003260000-0x0000000003261000-memory.dmp
memory/4124-1246-0x0000000003270000-0x0000000003271000-memory.dmp
memory/4124-1245-0x0000000003270000-0x0000000003271000-memory.dmp
memory/4124-1248-0x0000000003280000-0x0000000003281000-memory.dmp
memory/4124-1247-0x0000000003280000-0x0000000003281000-memory.dmp
memory/4124-1250-0x0000000003290000-0x0000000003291000-memory.dmp
memory/4124-1249-0x0000000003290000-0x0000000003291000-memory.dmp
memory/4124-1251-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/4124-1252-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/4124-1254-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/4124-1253-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/4124-1255-0x00000000032C0000-0x00000000032C1000-memory.dmp
memory/4124-1358-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-1325-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-1798-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-2258-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-2567-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-3088-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-3338-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-3508-0x0000000002EC0000-0x0000000002F18000-memory.dmp
memory/4124-3860-0x0000000002EC0000-0x0000000002F18000-memory.dmp