Overview
overview
7Static
static
3Labyrinth_WIN.exe
windows10-ltsc_2021-x64
7$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...gs.dll
windows10-ltsc_2021-x64
3$TEMP/dxwebsetup.exe
windows10-ltsc_2021-x64
7D3DX9_43.dll
windows10-ltsc_2021-x64
3Labrynth_24.exe
windows10-ltsc_2021-x64
3uninstall.exe
windows10-ltsc_2021-x64
7Analysis
- max time kernel
149s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
16/07/2026, 04:25
Behavioral task
behavioral1
Sample
Labyrinth_WIN.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$TEMP/dxwebsetup.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
D3DX9_43.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Labrynth_24.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
General
- Target Labyrinth_WIN.exe
- Size 12.9MB
- Sample260716-e1646acz4k
- SHA256 8e13463aa73356382d7401aee3bb160fc070769321c8d17663d71fff783af0db
- MD5 b435b45d8a1df8841af977c543f59b33
- SHA1 7a72c231bf653cf8e5effd772c82615f60b5a014
- SHA512 de2e1943ef9aadd285d28d260871ac4898d015937f95ad15ab4fcd195bb8b0e3e181b5c4bbfc538c32b072173078a9f8ea2f82398a1945cb5372fe99a29210cf
- SSDEEP 393216:60OdVAZ5xMH3ixa9CAUcBhp3xdsSSoHLYoBc:64vg9LUcBhphGSrRc
- TLSH T17DD633966E964983FD21C13E59B8EEB7BB77EEC416BC060181ED3C97B52328018BC571
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2636 dxwebsetup.exe 5076 dxwsetup.exe - Loads dropped DLL 4 IoCs
pid Process 5076 dxwsetup.exe 5212 Labyrinth_WIN.exe 5212 Labyrinth_WIN.exe 5212 Labyrinth_WIN.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dxwebsetup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: dxwsetup.exe File opened (read-only) \??\P: dxwsetup.exe File opened (read-only) \??\S: dxwsetup.exe File opened (read-only) \??\W: dxwsetup.exe File opened (read-only) \??\A: dxwsetup.exe File opened (read-only) \??\H: dxwsetup.exe File opened (read-only) \??\I: dxwsetup.exe File opened (read-only) \??\J: dxwsetup.exe File opened (read-only) \??\K: dxwsetup.exe File opened (read-only) \??\U: dxwsetup.exe File opened (read-only) \??\D: dxwsetup.exe File opened (read-only) \??\G: dxwsetup.exe File opened (read-only) \??\O: dxwsetup.exe File opened (read-only) \??\T: dxwsetup.exe File opened (read-only) \??\V: dxwsetup.exe File opened (read-only) \??\X: dxwsetup.exe File opened (read-only) \??\Y: dxwsetup.exe File opened (read-only) \??\Q: dxwsetup.exe File opened (read-only) \??\L: dxwsetup.exe File opened (read-only) \??\M: dxwsetup.exe File opened (read-only) \??\N: dxwsetup.exe File opened (read-only) \??\R: dxwsetup.exe File opened (read-only) \??\Z: dxwsetup.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\directx\websetup\SET8653.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll dxwsetup.exe File created C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET8652.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET8652.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET8653.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll dxwsetup.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\msdownld.tmp\AS588D9B.tmp\dxupdate.cab dxwsetup.exe File opened for modification C:\Windows\msdownld.tmp\AS588D9B.tmp dxwsetup.exe File opened for modification C:\Windows\Logs\DirectX.log dxwsetup.exe File opened for modification C:\Windows\msdownld.tmp\AS588D9B.tmp\dxupdate.cab dxwsetup.exe File created C:\Windows\msdownld.tmp\AS590481.tmp\dxupdate.cab dxwsetup.exe File opened for modification C:\Windows\msdownld.tmp\AS590481.tmp\dxupdate.cab dxwsetup.exe File opened for modification C:\Windows\msdownld.tmp\AS590481.tmp dxwsetup.exe File opened for modification C:\Windows\msdownld.tmp dxwsetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Labyrinth_WIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxwebsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxwsetup.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5212 wrote to memory of 2636 5212 Labyrinth_WIN.exe 91 PID 2636 wrote to memory of 5076 2636 dxwebsetup.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Labyrinth_WIN.exe"C:\Users\Admin\AppData\Local\Temp\Labyrinth_WIN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe" /Q2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5076
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DXIFFB8.tmp
- Size 56KB
- SHA256 ed710d035ccaab0914810becf2f5db2816dba3a351f3666a38a903c80c16997a
- MD5 2c4d9e4773084f33092ced15678a2c46
- SHA1 bad603d543470157effd4876a684b9cfd5075524
- SHA512 d2e34cac195cfede8bc64bdc92721c574963ff522618eda4d7172f664aeb4c8675fd3d4f3658391ee5eaa398bcd2ce5d8f80deecf51af176f5c4bb2d2695e04e
- SSDEEP 768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dl:epECjtutVj072Xwt7O49vQzztSZs5KLz
- TLSH T15343FB00F0F22DEE405A5C5A27895D6A0C9F64557C5D202EB9CE83B89FFC1ED93899E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
- Size 93KB
- SHA256 57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
- MD5 984cad22fa542a08c5d22941b888d8dc
- SHA1 3e3522e7f3af329f2235b0f0850d664d5377b3cd
- SHA512 8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef
- SSDEEP 1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa
- TLSH T186937D107694D176D9D220BD718CD7715ABEA6B01FA880CBBB461BDA8C653C0BA3D30F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
- Size 1.5MB
- SHA256 8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
- MD5 a5412a144f63d639b47fcc1ba68cb029
- SHA1 81bd5f1c99b22c0266f3f59959dfb4ea023be47e
- SHA512 2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405
- SSDEEP 24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
- TLSH T1EB759D31B1D40332EA7103B177128AB7F63EEB9DE119D62579AE82592182B9CC37E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.cif
- Size 65KB
- SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
- MD5 b36d3f105d18e55534ad605cbf061a92
- SHA1 788ef2de1dea6c8fe1d23a2e1007542f7321ed79
- SHA512 35ae00da025fd578205337a018b35176095a876cd3c3cf67a3e8a8e69cd750a4ccc34ce240f11fae3418e5e93caf5082c987f0c63f9d953ed7cb8d9271e03b62
- SSDEEP 768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
- TLSH T147633209734ED9FE900FF9A70EA66D4D686E81AB344D680E78FF52C50B3B4DD628D091
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
- Size 173KB
- SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
- MD5 7ed554b08e5b69578f9de012822c39c9
- SHA1 036d04513e134786b4758def5aff83d19bf50c6e
- SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
- SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
- TLSH T133047C19F640E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E36B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.inf
- Size 12KB
- SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
- MD5 e6a74342f328afa559d5b0544e113571
- SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
- SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
- SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
- TLSH T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif
- Size 56KB
- SHA256 762ff640013db2bd4109d7df43a867303093815751129bd1e33f16bf02e52cce
- MD5 7b1fbe9f5f43b2261234b78fe115cf8e
- SHA1 dd0f256ae38b4c4771e1d1ec001627017b7bb741
- SHA512 d21935a9867c0f2f7084917c79fbb1da885a1bfd4793cf669ff4da8c777b3a201857250bfb7c2b616625a8d3573c68395d210446d2c284b41cf09cc7cbb07885
- SSDEEP 768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dL:epECjtutVj072Xwt7O49vQzztSZs5KLV
- TLSH T17443FB00F0F22DEE405A5C5A27895D6A0C9F64557C5D202EB9CE83B89FFC1ED93899E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
- Size 515KB
- SHA256 8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
- MD5 ac3a5f7be8cd13a863b50ab5fe00b71c
- SHA1 eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9
- SHA512 c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba
- SSDEEP 3072:diqLKVd9Aqq3Z/yKxAG2ur4IhUNJ4g3nO9hpRH0gQSpHt+akOC8BTDmsikzWX+us:DFAKJr4IWNJ4MOrpRBQS3kydI+xyS
- TLSH T1EEB4F05032F4D926F2F32B743ABDE26148BA7D90AA38C24D2502565D1BF3B40A56CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
- Size 477B
- SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
- MD5 ad8982eaa02c7ad4d7cdcbc248caa941
- SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
- SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
- TLSH T191F05C5F6D438D0C30A535207AA346CBFF4C107051C5A08EB54DE05A87E87AD49AC0FF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
- Size 285KB
- SHA256 34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4
- MD5 bcbb7c0cd9696068988953990ec5bd11
- SHA1 3c8243734cf43dd7bb2332ba05b58ccacfa4377c
- SHA512 551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786
- SSDEEP 6144:3WK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQ43:mcvgLARDI1KIOzOR3
- TLSH T13454F15197E4817BE4FA1B351DF2025327797DA8ACB9E33E938618881D70380BE75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2E9E.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsr2E9E.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logs\DirectX.log
- Size 17KB
- SHA256 11470e4170cdb970778f62df215f98f53f5c403dcef5cd481909a646413adde9
- MD5 74cf6af6c006951e4e77d7a0b44502c7
- SHA1 68b5287f7c40e875c90c1315746005787c7ec1e2
- SHA512 8e60ee81308e6b449feb2cb3cb8386830f5b88ce87713c183b76a5cbfc81971a0aeebc13bdb52dc6b067712ebcc7f616b872cef1c6bf98793131cc13fe367f1f
- SSDEEP 96:n71te/eadA3Jrz6THuXU90go9undXmQh010JR2c1wZqV:nW2X3McaT+0JR2c13
- TLSH T16A82E36B6D0FF9222A6101045E1F17CD5919A20F034150F1E66D5F09EA2EFBB2A9F4EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
- Size 137B
- SHA256 f960075a7b1c2590e18700f3230f7baea9aced3e6ba5dc93dac193027b5cec48
- MD5 cec960807fa5bec11ad4a31c3512da4d
- SHA1 a3ac60a3518747d3bbead5edfd17e155cf7ce9f7
- SHA512 2da2d935f9b96bd36536f3a7a494775c8ed9bfef6538ffe66307b73cd5c82210fc43bbe6706d74d99dd5b924fb78a0d1beceee8c0e22d91e17b1346dd85690ec
- TLSH T129C02B850100F0BE000E6616483734E410B401E778828C1C004A41982F4055C448CC24
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
- Size 111B
- SHA256 e60413bec64775bf1933ef4f9673c8bcfbe0ce71e950fd589bbd14c0f9a00359
- MD5 d6f81567baaf05b557d9bc6c348cb5f1
- SHA1 0c840165fcd34d996c85b6b44b00c7206bf772b6
- SHA512 09b84cc9199592821d7de38cbe24332097b276bb25b6d09f7dcdc3a6b17369ee944a6f8120f13ea6a5c15eb759a90d7ce29cc845a5c0680ff2fa53e2623171e2
- TLSH T155B0128A4241F1BA000DBA67487B38D825F902FBB4818C5D018B06AD6B9156D84CCC14
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\msdownld.tmp\AS590481.tmp\dxupdate.cab
- Size 98KB
- SHA256 6e39b3fdb6722ea8aa0dc8f46ae0d8bd6496dd0f5f56bac618a0a7dd22d6cfb2
- MD5 4afd7f5c0574a0efd163740ecb142011
- SHA1 3ebca5343804fe94d50026da91647442da084302
- SHA512 6f974acec7d6c1b6a423b28810b0840e77a9f9c1f9632c5cba875bd895e076c7e03112285635cf633c2fa9a4d4e2f4a57437ae8df88a7882184ff6685ee15f3f
- SSDEEP 3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
- TLSH T16FA302EC8B5D8F93C5723CA5A1A8E90B7D7EF59E491CD02585B4F2442CA2BC9F3A045C
- MD5 SHA1 SHA512 SSDEEP TLSH