Resubmissions
21/07/2026, 17:38
260721-v7shcayyas713/07/2026, 17:10
260713-vp51qaev21713/07/2026, 05:48
260713-ghw8cact3q7Analysis
- max time kernel
298s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
13/07/2026, 17:10
General
- Target Setup.exe
- Size 94KB
- Sample260713-vp51qaev21
- SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 2002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3592 -ip 35921⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3592-0-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-1-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-4-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-15-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-11-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-9-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-7-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-6-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-23-0x000000007F980000-0x000000007F981000-memory.dmp
memory/3592-979-0x0000000002880000-0x0000000002881000-memory.dmp
memory/3592-1180-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-1414-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-978-0x0000000002870000-0x0000000002871000-memory.dmp
memory/3592-1532-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-977-0x0000000002870000-0x0000000002871000-memory.dmp
memory/3592-976-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3592-975-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3592-974-0x0000000002850000-0x0000000002851000-memory.dmp
memory/3592-973-0x0000000002850000-0x0000000002851000-memory.dmp
memory/3592-972-0x0000000002840000-0x0000000002841000-memory.dmp
memory/3592-971-0x0000000002840000-0x0000000002841000-memory.dmp
memory/3592-970-0x0000000002830000-0x0000000002831000-memory.dmp
memory/3592-969-0x0000000002830000-0x0000000002831000-memory.dmp
memory/3592-968-0x0000000002820000-0x0000000002821000-memory.dmp
memory/3592-967-0x0000000002820000-0x0000000002821000-memory.dmp
memory/3592-966-0x0000000002810000-0x0000000002811000-memory.dmp
memory/3592-965-0x0000000002810000-0x0000000002811000-memory.dmp
memory/3592-964-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3592-963-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3592-962-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3592-961-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3592-960-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/3592-959-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/3592-958-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/3592-957-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/3592-956-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/3592-955-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/3592-954-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/3592-953-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/3592-952-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/3592-951-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/3592-950-0x0000000002790000-0x0000000002791000-memory.dmp
memory/3592-949-0x0000000002790000-0x0000000002791000-memory.dmp
memory/3592-948-0x0000000002780000-0x0000000002781000-memory.dmp
memory/3592-947-0x0000000002780000-0x0000000002781000-memory.dmp
memory/3592-946-0x0000000002770000-0x0000000002771000-memory.dmp
memory/3592-945-0x0000000002770000-0x0000000002771000-memory.dmp
memory/3592-944-0x0000000002760000-0x0000000002761000-memory.dmp
memory/3592-943-0x0000000002760000-0x0000000002761000-memory.dmp
memory/3592-942-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/3592-941-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/3592-940-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/3592-939-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/3592-938-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/3592-937-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/3592-936-0x0000000000A80000-0x0000000000A81000-memory.dmp
memory/3592-935-0x0000000000A80000-0x0000000000A81000-memory.dmp
memory/3592-934-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/3592-933-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/3592-932-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/3592-931-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/3592-930-0x0000000000A40000-0x0000000000A41000-memory.dmp
memory/3592-929-0x0000000000A40000-0x0000000000A41000-memory.dmp
memory/3592-928-0x0000000000A30000-0x0000000000A31000-memory.dmp
memory/3592-927-0x0000000000A30000-0x0000000000A31000-memory.dmp
memory/3592-926-0x0000000000A20000-0x0000000000A21000-memory.dmp
memory/3592-925-0x0000000000A20000-0x0000000000A21000-memory.dmp
memory/3592-920-0x000000007FB10000-0x000000007FB15000-memory.dmp
memory/3592-1590-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-1673-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-2327-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-2066-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-2926-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-2647-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-3265-0x0000000000900000-0x000000000092F000-memory.dmp
memory/3592-3639-0x0000000000900000-0x000000000092F000-memory.dmp