Resubmissions
21/07/2026, 17:38
260721-v7s4wafp8y713/07/2026, 17:10
260713-vp7vbacv7r713/07/2026, 05:48
260713-ghv1aact3n7Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/07/2026, 05:48
General
- Target Setup.exe
- Size 94KB
- Sample260713-ghv1aact3n
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 6242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2640 -ip 26401⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2640-0-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-1-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-15-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-11-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-9-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-7-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-6-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-4-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-23-0x000000007FB80000-0x000000007FB81000-memory.dmp
memory/2640-1002-0x00000000031E0000-0x00000000031E1000-memory.dmp
memory/2640-1158-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-1428-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-1659-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-1157-0x0000000077CB2000-0x0000000077CB3000-memory.dmp
memory/2640-2043-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-2358-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-1914-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-2784-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-3123-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-3327-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-3664-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-3652-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-2617-0x0000000002A40000-0x0000000002A6E000-memory.dmp
memory/2640-1001-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/2640-1000-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/2640-999-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/2640-998-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/2640-997-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/2640-996-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/2640-995-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/2640-994-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/2640-993-0x0000000003190000-0x0000000003191000-memory.dmp
memory/2640-992-0x0000000003190000-0x0000000003191000-memory.dmp
memory/2640-991-0x0000000003180000-0x0000000003181000-memory.dmp
memory/2640-990-0x0000000003180000-0x0000000003181000-memory.dmp
memory/2640-989-0x0000000003170000-0x0000000003171000-memory.dmp
memory/2640-988-0x0000000003170000-0x0000000003171000-memory.dmp
memory/2640-987-0x0000000003160000-0x0000000003161000-memory.dmp
memory/2640-986-0x0000000003160000-0x0000000003161000-memory.dmp
memory/2640-985-0x0000000003150000-0x0000000003151000-memory.dmp
memory/2640-984-0x0000000003150000-0x0000000003151000-memory.dmp
memory/2640-983-0x0000000003140000-0x0000000003141000-memory.dmp
memory/2640-982-0x0000000003140000-0x0000000003141000-memory.dmp
memory/2640-981-0x0000000003130000-0x0000000003131000-memory.dmp
memory/2640-980-0x0000000003130000-0x0000000003131000-memory.dmp
memory/2640-979-0x0000000003120000-0x0000000003121000-memory.dmp
memory/2640-978-0x0000000003120000-0x0000000003121000-memory.dmp
memory/2640-977-0x0000000003110000-0x0000000003111000-memory.dmp
memory/2640-976-0x0000000003110000-0x0000000003111000-memory.dmp
memory/2640-975-0x0000000003100000-0x0000000003101000-memory.dmp
memory/2640-974-0x0000000003100000-0x0000000003101000-memory.dmp
memory/2640-973-0x00000000030F0000-0x00000000030F1000-memory.dmp
memory/2640-972-0x00000000030F0000-0x00000000030F1000-memory.dmp
memory/2640-971-0x00000000030E0000-0x00000000030E1000-memory.dmp
memory/2640-970-0x00000000030E0000-0x00000000030E1000-memory.dmp
memory/2640-969-0x00000000030D0000-0x00000000030D1000-memory.dmp
memory/2640-968-0x00000000030D0000-0x00000000030D1000-memory.dmp
memory/2640-967-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/2640-966-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/2640-965-0x00000000030B0000-0x00000000030B1000-memory.dmp
memory/2640-964-0x00000000030B0000-0x00000000030B1000-memory.dmp
memory/2640-963-0x00000000030A0000-0x00000000030A1000-memory.dmp
memory/2640-962-0x00000000030A0000-0x00000000030A1000-memory.dmp
memory/2640-961-0x0000000003090000-0x0000000003091000-memory.dmp
memory/2640-960-0x0000000003090000-0x0000000003091000-memory.dmp
memory/2640-959-0x0000000003080000-0x0000000003081000-memory.dmp
memory/2640-958-0x0000000003080000-0x0000000003081000-memory.dmp
memory/2640-957-0x0000000003070000-0x0000000003071000-memory.dmp
memory/2640-956-0x0000000003070000-0x0000000003071000-memory.dmp
memory/2640-955-0x0000000003050000-0x0000000003051000-memory.dmp
memory/2640-954-0x0000000003050000-0x0000000003051000-memory.dmp
memory/2640-953-0x0000000003040000-0x0000000003041000-memory.dmp
memory/2640-952-0x0000000003040000-0x0000000003041000-memory.dmp
memory/2640-951-0x0000000003030000-0x0000000003031000-memory.dmp
memory/2640-950-0x0000000003030000-0x0000000003031000-memory.dmp
memory/2640-949-0x0000000003020000-0x0000000003021000-memory.dmp
memory/2640-948-0x0000000003020000-0x0000000003021000-memory.dmp
memory/2640-943-0x000000007FD10000-0x000000007FD15000-memory.dmp