Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 12:18
General
- Target OktaVerifySetup-6.9.0.0-d51c7a0.exe
- Size 37.1MB
- Sample260602-pgpe4scz6x
- SHA256 fcc04b198677aa3e748ba390f4a8dc1ce5959d66d12354a574842a1830d220bd
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 13 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OktaVerifySetup-6.9.0.0-d51c7a0.exe"C:\Users\Admin\AppData\Local\Temp\OktaVerifySetup-6.9.0.0-d51c7a0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{E443B11B-AEEC-48AE-B5AD-01CD320FB9BB}\.cr\OktaVerifySetup-6.9.0.0-d51c7a0.exe"C:\Windows\Temp\{E443B11B-AEEC-48AE-B5AD-01CD320FB9BB}\.cr\OktaVerifySetup-6.9.0.0-d51c7a0.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\OktaVerifySetup-6.9.0.0-d51c7a0.exe" -burn.filehandle.attached=740 -burn.filehandle.self=7442⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
OktaVerifySetup-6.9.0.0-d51c7a0.exe
BootstrapperCore.config
BootstrapperCore.dll
Microsoft.ApplicationInsights.dll
Microsoft.Deployment.WindowsInstaller.dll
Newtonsoft.Json.dll
Okta.Installer.Foundations.dll
OktaVerifySetupApp.dll
mbahost.dll
memory/1360-58-0x0000000006390000-0x00000000063C4000-memory.dmp
memory/1360-84-0x000000000B640000-0x000000000B648000-memory.dmp
memory/1360-51-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-66-0x00000000063F0000-0x00000000063F8000-memory.dmp
memory/1360-50-0x0000000003380000-0x0000000003398000-memory.dmp
memory/1360-70-0x0000000006B00000-0x0000000006B62000-memory.dmp
memory/1360-71-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-45-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-75-0x0000000007130000-0x00000000071E0000-memory.dmp
memory/1360-78-0x00000000070F0000-0x0000000007112000-memory.dmp
memory/1360-79-0x00000000071E0000-0x0000000007537000-memory.dmp
memory/1360-62-0x0000000006820000-0x000000000684E000-memory.dmp
memory/1360-85-0x000000000B650000-0x000000000B658000-memory.dmp
memory/1360-86-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-87-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-88-0x000000000BD90000-0x000000000BDC8000-memory.dmp
memory/1360-89-0x000000000B630000-0x000000000B63E000-memory.dmp
memory/1360-90-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-91-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-92-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-93-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-94-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-95-0x0000000006410000-0x0000000006420000-memory.dmp
memory/1360-96-0x0000000006410000-0x0000000006420000-memory.dmp