Analysis
- user interaction
yes - max time kernel
80s - max time network
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/07/2026, 22:56
Errors
General
- Target Setup (1) (1).exe
- Size 5.0MB
- Sample260711-2w6ddsaz9m
- SHA256 7367aeb0e202b0a50976993fb2750e75a5215f9a0966fc8fb4e84807ba3b57f1
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (1) (1).exe"C:\Users\Admin\AppData\Local\Temp\Setup (1) (1).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OculusSetup-406f27c5-f62a-4413-aa1e-ef3d5a2b9019\Setup.exeC:\Users\Admin\AppData\Local\Temp\\OculusSetup-406f27c5-f62a-4413-aa1e-ef3d5a2b9019\Setup.exe --setupPath "C:\Users\Admin\AppData\Local\Temp\Setup (1) (1).exe"2⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a26055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DaybreakNative.dll
libcrypto.dll
Setup.exe
memory/3528-24-0x00000000083C0000-0x0000000008452000-memory.dmp
memory/3528-27-0x0000000008780000-0x0000000008854000-memory.dmp
memory/3528-10-0x0000000005510000-0x0000000005544000-memory.dmp
memory/3528-11-0x00000000058B0000-0x0000000005A72000-memory.dmp
memory/3528-12-0x0000000005FB0000-0x00000000064DC000-memory.dmp
memory/3528-16-0x0000000005DA0000-0x0000000005DEA000-memory.dmp
memory/3528-18-0x0000000005D70000-0x0000000005D7C000-memory.dmp
memory/3528-19-0x00000000064E0000-0x0000000006546000-memory.dmp
memory/3528-17-0x0000000005D60000-0x0000000005D70000-memory.dmp
memory/3528-20-0x0000000006A60000-0x0000000006AC6000-memory.dmp
memory/3528-21-0x0000000007E60000-0x0000000007EE6000-memory.dmp
memory/3528-22-0x0000000007F60000-0x0000000007F82000-memory.dmp
memory/3528-23-0x0000000007F90000-0x00000000082EB000-memory.dmp
memory/3528-8-0x00000000050D0000-0x0000000005124000-memory.dmp
memory/3528-9-0x0000000073CC0000-0x000000007447C000-memory.dmp
memory/3528-25-0x0000000073CC0000-0x000000007447C000-memory.dmp
memory/3528-29-0x000000000B520000-0x000000000B55E000-memory.dmp
memory/3528-28-0x000000000A990000-0x000000000A998000-memory.dmp
memory/3528-26-0x0000000008390000-0x00000000083A2000-memory.dmp
memory/3528-30-0x000000000B500000-0x000000000B50E000-memory.dmp
memory/3528-7-0x00000000002A0000-0x000000000078A000-memory.dmp
memory/3528-34-0x000000000C0F0000-0x000000000C166000-memory.dmp
memory/3528-35-0x000000000A930000-0x000000000A94E000-memory.dmp
memory/3528-36-0x0000000073CC0000-0x000000007447C000-memory.dmp
memory/3528-37-0x0000000073CD2000-0x0000000073CD3000-memory.dmp
memory/3528-38-0x0000000073CC0000-0x000000007447C000-memory.dmp
memory/3528-6-0x0000000073CD2000-0x0000000073CD3000-memory.dmp
memory/3528-43-0x0000000073CC0000-0x000000007447C000-memory.dmp
memory/3528-44-0x0000000073CC0000-0x000000007447C000-memory.dmp
memory/3528-45-0x0000000073CC0000-0x000000007447C000-memory.dmp
memory/3528-49-0x0000000073CC0000-0x000000007447C000-memory.dmp