Resubmissions
11/05/2026, 17:21
260511-vxfe2afw5z511/05/2026, 17:10
260511-vpp99say4m511/05/2026, 16:45
260511-t9cz1aez6s5Analysis
- max time kernel
298s - max time network
279s - platform
windows11-21h2_x64 - resource
win11-20260130-es - resource tags
- submitted
11/05/2026, 17:10
General
- Target Setup.exe
- Size 1009KB
- Sample260511-vpp99say4m
- SHA256 a0706de5c6c1b2845c0730135628e05bfcf536fea5f7c64d3681ce289cfa410f
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 7762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 8 -ip 81⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/8-0-0x0000000003350000-0x00000000033A8000-memory.dmp
memory/8-1-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-7-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-6-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-4-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-9-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-11-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-15-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-23-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-354-0x00000000FED40000-0x00000000FED41000-memory.dmp
memory/8-348-0x0000000000C90000-0x0000000000F1B000-memory.dmp
memory/8-3075-0x00000000FEED0000-0x00000000FEED5000-memory.dmp
memory/8-3132-0x0000000003730000-0x0000000003731000-memory.dmp
memory/8-3216-0x0000000003350000-0x00000000033A8000-memory.dmp
memory/8-3244-0x0000000003350000-0x00000000033A8000-memory.dmp
memory/8-3131-0x0000000003720000-0x0000000003721000-memory.dmp
memory/8-3130-0x0000000003720000-0x0000000003721000-memory.dmp
memory/8-3129-0x0000000003710000-0x0000000003711000-memory.dmp
memory/8-3128-0x0000000003710000-0x0000000003711000-memory.dmp
memory/8-3127-0x0000000003700000-0x0000000003701000-memory.dmp
memory/8-3126-0x0000000003700000-0x0000000003701000-memory.dmp
memory/8-3125-0x00000000036F0000-0x00000000036F1000-memory.dmp
memory/8-3124-0x00000000036F0000-0x00000000036F1000-memory.dmp
memory/8-3123-0x00000000036E0000-0x00000000036E1000-memory.dmp
memory/8-3122-0x00000000036E0000-0x00000000036E1000-memory.dmp
memory/8-3121-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/8-3120-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/8-3119-0x00000000036C0000-0x00000000036C1000-memory.dmp
memory/8-3118-0x00000000036C0000-0x00000000036C1000-memory.dmp
memory/8-3117-0x00000000036B0000-0x00000000036B1000-memory.dmp
memory/8-3103-0x0000000003640000-0x0000000003641000-memory.dmp
memory/8-3115-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/8-3114-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/8-3113-0x0000000003690000-0x0000000003691000-memory.dmp
memory/8-3112-0x0000000003690000-0x0000000003691000-memory.dmp
memory/8-3111-0x0000000003680000-0x0000000003681000-memory.dmp
memory/8-3110-0x0000000003680000-0x0000000003681000-memory.dmp
memory/8-3109-0x0000000003670000-0x0000000003671000-memory.dmp
memory/8-3108-0x0000000003670000-0x0000000003671000-memory.dmp
memory/8-3107-0x0000000003660000-0x0000000003661000-memory.dmp
memory/8-3106-0x0000000003660000-0x0000000003661000-memory.dmp
memory/8-3105-0x0000000003650000-0x0000000003651000-memory.dmp
memory/8-3104-0x0000000003650000-0x0000000003651000-memory.dmp
memory/8-3101-0x0000000003630000-0x0000000003631000-memory.dmp
memory/8-3100-0x0000000003630000-0x0000000003631000-memory.dmp
memory/8-3099-0x0000000003620000-0x0000000003621000-memory.dmp
memory/8-3098-0x0000000003620000-0x0000000003621000-memory.dmp
memory/8-3097-0x0000000003610000-0x0000000003611000-memory.dmp
memory/8-3096-0x0000000003610000-0x0000000003611000-memory.dmp
memory/8-3095-0x0000000003600000-0x0000000003601000-memory.dmp
memory/8-3094-0x0000000003600000-0x0000000003601000-memory.dmp
memory/8-3093-0x00000000035F0000-0x00000000035F1000-memory.dmp
memory/8-3092-0x00000000035F0000-0x00000000035F1000-memory.dmp
memory/8-3091-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/8-3090-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/8-3089-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/8-3088-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/8-3087-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/8-3086-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/8-3084-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/8-3083-0x0000000003590000-0x0000000003591000-memory.dmp
memory/8-3082-0x0000000003590000-0x0000000003591000-memory.dmp
memory/8-3081-0x0000000003580000-0x0000000003581000-memory.dmp
memory/8-3080-0x0000000003580000-0x0000000003581000-memory.dmp
memory/8-3116-0x00000000036B0000-0x00000000036B1000-memory.dmp
memory/8-3102-0x0000000003640000-0x0000000003641000-memory.dmp
memory/8-3085-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/8-3251-0x0000000003350000-0x00000000033A8000-memory.dmp
memory/8-3563-0x0000000003350000-0x00000000033A8000-memory.dmp
memory/8-3896-0x0000000003350000-0x00000000033A8000-memory.dmp