Resubmissions
21/07/2026, 17:38
260721-v7shcayyas713/07/2026, 17:10
260713-vp51qaev21713/07/2026, 05:48
260713-ghw8cact3q7Analysis
- max time kernel
298s - max time network
184s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
13/07/2026, 17:10
General
- Target Setup.exe
- Size 94KB
- Sample260713-vp51qaev21
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 6242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 35881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3588-0-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-15-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-11-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-9-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-7-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-6-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-4-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-23-0x000000007FAF0000-0x000000007FAF1000-memory.dmp
memory/3588-912-0x00000000777D2000-0x00000000777D3000-memory.dmp
memory/3588-944-0x000000007FC80000-0x000000007FC85000-memory.dmp
memory/3588-950-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/3588-949-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/3588-952-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/3588-951-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/3588-954-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/3588-953-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/3588-956-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/3588-955-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/3588-958-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/3588-957-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/3588-960-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/3588-959-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/3588-962-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/3588-961-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/3588-964-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/3588-963-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/3588-966-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/3588-965-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/3588-968-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/3588-967-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/3588-970-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/3588-969-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/3588-972-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/3588-971-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/3588-974-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/3588-973-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/3588-976-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/3588-975-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/3588-978-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
memory/3588-977-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
memory/3588-980-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
memory/3588-979-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
memory/3588-982-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
memory/3588-981-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
memory/3588-984-0x0000000002CD0000-0x0000000002CD1000-memory.dmp
memory/3588-983-0x0000000002CD0000-0x0000000002CD1000-memory.dmp
memory/3588-986-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/3588-985-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/3588-988-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/3588-987-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/3588-990-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/3588-989-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/3588-992-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/3588-991-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/3588-994-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/3588-993-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/3588-996-0x0000000002D30000-0x0000000002D31000-memory.dmp
memory/3588-995-0x0000000002D30000-0x0000000002D31000-memory.dmp
memory/3588-998-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/3588-997-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/3588-1000-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3588-999-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3588-1002-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/3588-1001-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/3588-1003-0x0000000002D70000-0x0000000002D71000-memory.dmp
memory/3588-1182-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1164-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1249-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1137-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1126-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1109-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1092-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1485-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1797-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-1796-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-2375-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-2707-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-2035-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-3097-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-3400-0x00000000025F0000-0x000000000261F000-memory.dmp
memory/3588-3668-0x00000000025F0000-0x000000000261F000-memory.dmp