Resubmissions
21/07/2026, 17:38
260721-v7shcayyas713/07/2026, 17:10
260713-vp51qaev21713/07/2026, 05:48
260713-ghw8cact3q7Analysis
- max time kernel
298s - max time network
186s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
13/07/2026, 17:10
General
- Target Setup.exe
- Size 94KB
- Sample260713-vp51qaev21
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 6522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 872 -ip 8721⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/872-0-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-15-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-11-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-9-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-6-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-4-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-7-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-23-0x000000007F520000-0x000000007F521000-memory.dmp
memory/872-935-0x00000000770D3000-0x00000000770D4000-memory.dmp
memory/872-967-0x000000007F6B0000-0x000000007F6B5000-memory.dmp
memory/872-973-0x0000000001750000-0x0000000001751000-memory.dmp
memory/872-972-0x0000000001750000-0x0000000001751000-memory.dmp
memory/872-975-0x0000000001760000-0x0000000001761000-memory.dmp
memory/872-974-0x0000000001760000-0x0000000001761000-memory.dmp
memory/872-977-0x0000000001770000-0x0000000001771000-memory.dmp
memory/872-976-0x0000000001770000-0x0000000001771000-memory.dmp
memory/872-979-0x0000000001780000-0x0000000001781000-memory.dmp
memory/872-978-0x0000000001780000-0x0000000001781000-memory.dmp
memory/872-981-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
memory/872-980-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
memory/872-983-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
memory/872-982-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
memory/872-985-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/872-984-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/872-987-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/872-986-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/872-989-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/872-988-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/872-991-0x0000000003000000-0x0000000003001000-memory.dmp
memory/872-990-0x0000000003000000-0x0000000003001000-memory.dmp
memory/872-993-0x0000000003010000-0x0000000003011000-memory.dmp
memory/872-992-0x0000000003010000-0x0000000003011000-memory.dmp
memory/872-995-0x0000000003020000-0x0000000003021000-memory.dmp
memory/872-994-0x0000000003020000-0x0000000003021000-memory.dmp
memory/872-997-0x0000000003030000-0x0000000003031000-memory.dmp
memory/872-996-0x0000000003030000-0x0000000003031000-memory.dmp
memory/872-998-0x0000000003040000-0x0000000003041000-memory.dmp
memory/872-1000-0x0000000003050000-0x0000000003051000-memory.dmp
memory/872-999-0x0000000003040000-0x0000000003041000-memory.dmp
memory/872-1002-0x0000000003060000-0x0000000003061000-memory.dmp
memory/872-1001-0x0000000003050000-0x0000000003051000-memory.dmp
memory/872-1004-0x0000000003070000-0x0000000003071000-memory.dmp
memory/872-1003-0x0000000003060000-0x0000000003061000-memory.dmp
memory/872-1006-0x0000000003470000-0x0000000003471000-memory.dmp
memory/872-1007-0x0000000003470000-0x0000000003471000-memory.dmp
memory/872-1005-0x0000000003070000-0x0000000003071000-memory.dmp
memory/872-1009-0x0000000003480000-0x0000000003481000-memory.dmp
memory/872-1008-0x0000000003480000-0x0000000003481000-memory.dmp
memory/872-1011-0x0000000003490000-0x0000000003491000-memory.dmp
memory/872-1010-0x0000000003490000-0x0000000003491000-memory.dmp
memory/872-1013-0x00000000034A0000-0x00000000034A1000-memory.dmp
memory/872-1012-0x00000000034A0000-0x00000000034A1000-memory.dmp
memory/872-1015-0x00000000034B0000-0x00000000034B1000-memory.dmp
memory/872-1014-0x00000000034B0000-0x00000000034B1000-memory.dmp
memory/872-1017-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/872-1016-0x00000000034C0000-0x00000000034C1000-memory.dmp
memory/872-1019-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/872-1018-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/872-1021-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/872-1020-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/872-1023-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/872-1022-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/872-1025-0x0000000003500000-0x0000000003501000-memory.dmp
memory/872-1024-0x0000000003500000-0x0000000003501000-memory.dmp
memory/872-1026-0x0000000003510000-0x0000000003511000-memory.dmp
memory/872-1121-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1226-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1502-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1193-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1162-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-2072-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-2287-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-2537-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-3145-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-3472-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-3692-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-2825-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1817-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1153-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1134-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1110-0x0000000001490000-0x00000000014BF000-memory.dmp
memory/872-1079-0x0000000001490000-0x00000000014BF000-memory.dmp