Resubmissions
07/07/2026, 14:19
260707-rmtccsbv71607/07/2026, 13:58
260707-q9152sgv6q507/07/2026, 13:39
260707-qx27ksgs3m5Analysis
- max time kernel
298s - max time network
194s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
07/07/2026, 14:19
General
- Target Setup.exe
- Size 94KB
- Sample260707-rmtccsbv71
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 6522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1084 -ip 10841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1084-0-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-15-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-11-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-9-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-7-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-6-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-4-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-23-0x000000007F6A0000-0x000000007F6A1000-memory.dmp
memory/1084-935-0x0000000077283000-0x0000000077284000-memory.dmp
memory/1084-967-0x000000007F830000-0x000000007F835000-memory.dmp
memory/1084-973-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/1084-972-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/1084-975-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/1084-974-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/1084-977-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/1084-976-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/1084-979-0x0000000000F40000-0x0000000000F41000-memory.dmp
memory/1084-978-0x0000000000F40000-0x0000000000F41000-memory.dmp
memory/1084-981-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1084-980-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1084-983-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/1084-982-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/1084-984-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/1084-985-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/1084-987-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/1084-986-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/1084-989-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1084-988-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1084-991-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/1084-990-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/1084-993-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/1084-992-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/1084-995-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/1084-994-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/1084-997-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/1084-996-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/1084-999-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/1084-998-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/1084-1001-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/1084-1000-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/1084-1003-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/1084-1002-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/1084-1005-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/1084-1006-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/1084-1004-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/1084-1008-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/1084-1007-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/1084-1010-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/1084-1009-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/1084-1012-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/1084-1013-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/1084-1011-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/1084-1015-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/1084-1014-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/1084-1017-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/1084-1016-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/1084-1019-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/1084-1018-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/1084-1021-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/1084-1020-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/1084-1023-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/1084-1022-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/1084-1025-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/1084-1024-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/1084-1026-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/1084-1249-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1217-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1451-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1200-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1565-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1808-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1886-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-1996-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-2162-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-2333-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-2437-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-2426-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-2980-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-3132-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-2528-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-3685-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-3693-0x0000000000C00000-0x0000000000C2E000-memory.dmp
memory/1084-3369-0x0000000000C00000-0x0000000000C2E000-memory.dmp