Overview

overview

8

Static

static

3

RealSetup_...75.exe

windows11-ltsc_2024-x64

8

RealSetup_...75.exe

windows10-2004-x64

7

RealSetup_...75.exe

windows10-ltsc_2021-x64

7

RealSetup_...75.exe

windows11-21h2-x64

7

remote_admin.pyc

windows11-ltsc_2024-x64

3

remote_admin.pyc

windows10-2004-x64

3

remote_admin.pyc

windows10-ltsc_2021-x64

3

remote_admin.pyc

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    601s
  • max time network
    473s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
  • Size 79.4MB
  • Sample260705-e7vdyahv8w
  • SHA256 179f92f362a7a2115611cacf7d7ee1c5697d63f77e03b41fec5b66d4aadfd9ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 33 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
    "C:\Users\Admin\AppData\Local\Temp\RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5992
    • C:\Users\Admin\AppData\Local\Temp\RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe
      "C:\Users\Admin\AppData\Local\Temp\RealSetup_9f8ae8c64ad01f3ed2fd4066d1c189add11ff7f197abfe84e3762775.exe"
      2⤵
      • Loads dropped DLL
      PID:5660
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5984
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4300
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2644
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5204
  • C:\Windows\System32\oobe\UserOOBEBroker.exe
    C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    PID:3480
  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:912
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5772

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 595B
          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
          • Size 211KB
          • SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_aes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Cipher\_raw_aes.pyd
          • Size 34KB
          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_aesni.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Cipher\_raw_aesni.pyd
          • Size 15KB
          • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_ctr.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Cipher\_raw_ctr.pyd
          • Size 14KB
          • SHA256 aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_ecb.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Cipher\_raw_ecb.pyd
          • Size 10KB
          • SHA256 98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _BLAKE2s.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Hash\_BLAKE2s.pyd
          • Size 13KB
          • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ghash_clmul.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Hash\_ghash_clmul.pyd
          • Size 12KB
          • SHA256 63d9bbdac4e8e2c95b1a41eb7a2b42047b6a0c8d36447165e32167d3c7a57aee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ghash_portable.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Hash\_ghash_portable.pyd
          • Size 12KB
          • SHA256 ca4c4e24af0d7f879f9cb73df6e27f83441071dd466c366a4f4b467101e50e21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cpuid_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\Crypto\Util\_cpuid_c.pyd
          • Size 10KB
          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _imaging.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\PIL\_imaging.cp314-win_amd64.pyd
          • Size 2.5MB
          • SHA256 d823c0e3b54035d08703bb427c553c956c2607b79395f2952e17a5447c5f1105
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_bz2.pyd
          • Size 85KB
          • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_ctypes.pyd
          • Size 139KB
          • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_hashlib.pyd
          • Size 67KB
          • SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_lzma.pyd
          • Size 157KB
          • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_queue.pyd
          • Size 35KB
          • SHA256 bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_socket.pyd
          • Size 85KB
          • SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_sqlite3.pyd
          • Size 129KB
          • SHA256 b0c4edff6d60f300373ec929ab915f95ee601bf167e04d28e4e9e28a8e536fe0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_ssl.pyd
          • Size 186KB
          • SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_uuid.pyd
          • Size 27KB
          • SHA256 a09308efd309732e3745e70b4456235579c450cac32bed616dfb3913b56f6637
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_wmi.pyd
          • Size 39KB
          • SHA256 0ab1fbcf18c95d70343012feb1aad61e1ba95aaed5b4a08e57fc5990e8a9a452
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _zstd.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\_zstd.pyd
          • Size 491KB
          • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\base_library.zip
          • Size 1.3MB
          • SHA256 bb94bfba5ab113a5cdc602fef3e692e3d88a685905cd4e75aebc56ffbedde172
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\charset_normalizer\cd.cp314-win_amd64.pyd
          • Size 10KB
          • SHA256 da3ce780d6d58ae8c6920b99f806f64d58a1b33f4a01382861b01b50549199f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\libcrypto-3.dll
          • Size 6.0MB
          • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\libssl-3.dll
          • Size 1.3MB
          • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INSTALLER
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\pycryptodome-3.23.0.dist-info\INSTALLER
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\python3.DLL
          • Size 72KB
          • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python314.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\python314.dll
          • Size 6.5MB
          • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\select.pyd
          • Size 32KB
          • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI59922\sqlite3.dll
          • Size 1.5MB
          • SHA256 3557565665e608cd24726730e52690a131efcb0e2d5090337b2e05fb89d49c76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2644-641-0x0000021494210000-0x0000021494230000-memory.dmp
          Download

          memory/2644-608-0x0000021493E90000-0x0000021493F90000-memory.dmp
          Download

          memory/2644-588-0x00000214801E0000-0x00000214802E0000-memory.dmp
          Download

          memory/2644-589-0x00000214801E0000-0x00000214802E0000-memory.dmp
          Download

          memory/2644-618-0x0000021483C90000-0x0000021483CB0000-memory.dmp
          Download

          memory/2644-607-0x0000021483A30000-0x0000021483A50000-memory.dmp
          Download