Analysis
- max time kernel
299s - max time network
185s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
13/07/2026, 00:43
General
- Target Setup.exe
- Size 94KB
- Sample260713-a24cfaav2j
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 6602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1484 -ip 14841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1484-0-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-15-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-11-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-9-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-7-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-6-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-4-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-23-0x000000007EE20000-0x000000007EE21000-memory.dmp
memory/1484-935-0x0000000077B53000-0x0000000077B54000-memory.dmp
memory/1484-967-0x000000007EFB0000-0x000000007EFB5000-memory.dmp
memory/1484-973-0x0000000002970000-0x0000000002971000-memory.dmp
memory/1484-972-0x0000000002970000-0x0000000002971000-memory.dmp
memory/1484-975-0x0000000002980000-0x0000000002981000-memory.dmp
memory/1484-974-0x0000000002980000-0x0000000002981000-memory.dmp
memory/1484-977-0x0000000002990000-0x0000000002991000-memory.dmp
memory/1484-976-0x0000000002990000-0x0000000002991000-memory.dmp
memory/1484-979-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/1484-978-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/1484-981-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/1484-980-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/1484-983-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/1484-982-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/1484-985-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/1484-984-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/1484-987-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/1484-986-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/1484-989-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/1484-988-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/1484-991-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/1484-990-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/1484-993-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/1484-992-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/1484-995-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/1484-994-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/1484-997-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/1484-996-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/1484-999-0x0000000002A50000-0x0000000002A51000-memory.dmp
memory/1484-998-0x0000000002A50000-0x0000000002A51000-memory.dmp
memory/1484-1001-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/1484-1000-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/1484-1003-0x0000000002A70000-0x0000000002A71000-memory.dmp
memory/1484-1002-0x0000000002A70000-0x0000000002A71000-memory.dmp
memory/1484-1005-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/1484-1004-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/1484-1007-0x0000000002A90000-0x0000000002A91000-memory.dmp
memory/1484-1006-0x0000000002A90000-0x0000000002A91000-memory.dmp
memory/1484-1009-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
memory/1484-1008-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
memory/1484-1010-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/1484-1011-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/1484-1013-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/1484-1012-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/1484-1015-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/1484-1014-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/1484-1017-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/1484-1016-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/1484-1020-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1484-1019-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/1484-1018-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/1484-1021-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1484-1023-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/1484-1022-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/1484-1025-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/1484-1024-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/1484-1026-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/1484-1221-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1212-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1613-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1197-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-2117-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-2373-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-2716-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-3066-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-3667-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-3693-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-3294-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1853-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1166-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1141-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1120-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1103-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1091-0x0000000000AD0000-0x0000000000AFE000-memory.dmp
memory/1484-1080-0x0000000000AD0000-0x0000000000AFE000-memory.dmp