Analysis
- max time kernel
149s - max time network
186s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 19:34
General
- Target Kaspersky Premium 21.22/Kaspersky Premium 21.22.exe
- Size 615.4MB
- Sample260723-x98nfstyay
- SHA256 3a2a773da3399382e5a96d66dd764dbe2c1542a8c8ca395ced039a0b1f6aded9
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 2 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 64 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe"C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\17E97409EC681F114BA0A59BE36A1458\Kaspersky Premium 21.22.exe"C:\Windows\temp\17E97409EC681F114BA0A59BE36A1458\Kaspersky Premium 21.22.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E48CA119EC681F114BA0A59BE36A1458\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\E48CA119EC681F114BA0A59BE36A1458\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAA2P7Se/e6WHov0DAg/Hh2CAlQAAIgR//+R4LOfJ/4dki4AGAAHAFIAcABoAGoAbgB5AGwAagAAAAcAMQAwAC4AMQAyADcALgAwAC4ANgA4AAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==:3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.25.7.504.0.414.0\au_setup_A72FB027-86CE-11F1-B40A-5AB93EA64185\startup.exe"C:\ProgramData\Kaspersky Lab Setup Files\KIS21.25.7.504.0.414.0\au_setup_A72FB027-86CE-11F1-B40A-5AB93EA64185\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" /-self_remove -l=ru-RU -prevsetupver=21.22.7.466.0.4.0 -xpos=590 -ypos=238 -local_found3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\C5F92C0BEC681F114BA0A59BE36A1458\startup.exe"C:\Windows\temp\C5F92C0BEC681F114BA0A59BE36A1458\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" /-self_remove -l=ru-RU -prevsetupver=21.22.7.466.0.4.0 -xpos=590 -ypos=238 -local_found4⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C985ED1BEC681F114BA0A59BE36A1458\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\C985ED1BEC681F114BA0A59BE36A1458\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADlJCsaJMAG0lU54FilIM81ArQAAAwG//84YzV+UWNqXS4AGAAHAFIAcABoAGoAbgB5AGwAagAAAAcAMQAwAC4AMQAyADcALgAwAC4ANgA4AAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==:5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kdscrl.rdb
startup.exe
kdscrl.rdb.z
kl.setup.ui.interoplayer.dll
setup.dll
setup_ui.exe
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
memory/440-1-0x0000000077B50000-0x0000000077B60000-memory.dmp
memory/440-2-0x0000000077B50000-0x0000000077B60000-memory.dmp
memory/440-0-0x0000000077B50000-0x0000000077B60000-memory.dmp
memory/1316-83-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/1316-78-0x0000000005070000-0x0000000005086000-memory.dmp
memory/1316-109-0x0000000006CE0000-0x0000000006CFC000-memory.dmp
memory/1316-101-0x0000000006C40000-0x0000000006C56000-memory.dmp
memory/1316-92-0x0000000006090000-0x000000000613C000-memory.dmp
memory/1316-97-0x0000000006C70000-0x0000000006CB8000-memory.dmp
memory/1316-88-0x0000000005FC0000-0x0000000005FD2000-memory.dmp
memory/1316-117-0x0000000006E40000-0x0000000006EF4000-memory.dmp
memory/1316-84-0x0000000006290000-0x0000000006834000-memory.dmp
memory/1316-113-0x0000000006D40000-0x0000000006D74000-memory.dmp
memory/1316-82-0x0000000005970000-0x0000000005CDA000-memory.dmp
memory/1316-121-0x0000000006D20000-0x0000000006D40000-memory.dmp
memory/1316-122-0x000000000B030000-0x000000000B0C2000-memory.dmp
memory/1316-105-0x0000000006C30000-0x0000000006C40000-memory.dmp
memory/1316-128-0x000000000B0D0000-0x000000000B110000-memory.dmp
memory/1316-129-0x0000000005460000-0x0000000005468000-memory.dmp
memory/1316-130-0x000000000B190000-0x000000000B1C8000-memory.dmp
memory/1316-131-0x000000000B160000-0x000000000B16E000-memory.dmp
memory/1316-132-0x0000000000AE0000-0x0000000000B87000-memory.dmp
memory/1316-74-0x00000000051A0000-0x00000000051FA000-memory.dmp
memory/1316-49-0x0000000004F50000-0x0000000004F9A000-memory.dmp
memory/1316-42-0x0000000002940000-0x000000000294E000-memory.dmp
memory/1548-166-0x0000000077B40000-0x0000000077B50000-memory.dmp
memory/1548-167-0x0000000077B40000-0x0000000077B50000-memory.dmp
memory/1548-168-0x0000000077B40000-0x0000000077B50000-memory.dmp
memory/3096-159-0x0000000077B50000-0x0000000077B60000-memory.dmp
memory/3096-160-0x0000000077B50000-0x0000000077B60000-memory.dmp
memory/3096-161-0x0000000077B50000-0x0000000077B60000-memory.dmp
memory/4488-8-0x0000000077B60000-0x0000000077B70000-memory.dmp
memory/4488-7-0x0000000077B60000-0x0000000077B70000-memory.dmp
memory/4488-6-0x0000000077B60000-0x0000000077B70000-memory.dmp
memory/4508-235-0x0000000005F50000-0x0000000005F76000-memory.dmp
memory/4508-243-0x0000000006C70000-0x0000000006C8C000-memory.dmp
memory/4508-231-0x0000000004F90000-0x0000000004FA6000-memory.dmp
memory/4508-232-0x0000000005890000-0x0000000005C38000-memory.dmp
memory/4508-236-0x0000000006040000-0x00000000060F4000-memory.dmp
memory/4508-209-0x0000000004E00000-0x0000000004E50000-memory.dmp
memory/4508-240-0x0000000006C00000-0x0000000006C48000-memory.dmp
memory/4508-230-0x0000000005030000-0x0000000005098000-memory.dmp
memory/4508-242-0x0000000006BF0000-0x0000000006C00000-memory.dmp
memory/4508-241-0x0000000006BD0000-0x0000000006BE6000-memory.dmp
memory/4508-244-0x0000000006CD0000-0x0000000006D04000-memory.dmp
memory/4508-245-0x0000000006DD0000-0x0000000006E84000-memory.dmp
memory/4508-246-0x0000000006C90000-0x0000000006CB0000-memory.dmp
memory/4508-247-0x000000000AF40000-0x000000000AFA0000-memory.dmp
memory/4508-205-0x00000000048C0000-0x00000000048CE000-memory.dmp
memory/4508-260-0x0000000000100000-0x00000000001B5000-memory.dmp