Analysis
- max time kernel
169s - max time network
215s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 19:34
General
- Target Kaspersky Premium 21.22/Kaspersky Premium 21.22.exe
- Size 615.4MB
- Sample260723-x98nfstyay
- SHA256 3a2a773da3399382e5a96d66dd764dbe2c1542a8c8ca395ced039a0b1f6aded9
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 2 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 64 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe"C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\FF1952D9EC681F1138F1673CBD98E309\Kaspersky Premium 21.22.exe"C:\Windows\temp\FF1952D9EC681F1138F1673CBD98E309\Kaspersky Premium 21.22.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3F8AE31AEC681F1138F1673CBD98E309\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\3F8AE31AEC681F1138F1673CBD98E309\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAACHEsMT8cxnZypHcaja8VcAjAAAIgX//9DEHo3zSF/Zi8AGQAHAE0AZAB1AGsAYgByAHAAZAAAAAcAMQAwAC4AMQAyADcALgAxAC4AMQA2ADkAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.25.7.504.0.414.0\au_setup_AE2CD70D-86CE-11F1-831F-76C3DB893E90\startup.exe"C:\ProgramData\Kaspersky Lab Setup Files\KIS21.25.7.504.0.414.0\au_setup_AE2CD70D-86CE-11F1-831F-76C3DB893E90\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" /-self_remove -l=ru-RU -prevsetupver=21.22.7.466.0.4.0 -xpos=590 -ypos=234 -local_found3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\E9E57DEAEC681F1138F1673CBD98E309\startup.exe"C:\Windows\temp\E9E57DEAEC681F1138F1673CBD98E309\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\Kaspersky Premium 21.22\Kaspersky Premium 21.22.exe" /-self_remove -l=ru-RU -prevsetupver=21.22.7.466.0.4.0 -xpos=590 -ypos=234 -local_found4⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\04A319FAEC681F1138F1673CBD98E309\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\04A319FAEC681F1138F1673CBD98E309\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADxMyvRO/VPnSGlAolCGtf7ArQAAAQM//+Y4liGXR81gi8AGQAHAE0AZAB1AGsAYgByAHAAZAAAAAcAMQAwAC4AMQAyADcALgAxAC4AMQA2ADkAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kdscrl.rdb
startup.exe
kdscrl.rdb.z
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
setup.dll
setup_ui.exe
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
discovery.cfg
memory/1984-209-0x0000000003600000-0x000000000360E000-memory.dmp
memory/1984-247-0x0000000008480000-0x000000000849C000-memory.dmp
memory/1984-236-0x0000000006010000-0x0000000006078000-memory.dmp
memory/1984-242-0x0000000006E50000-0x0000000006E76000-memory.dmp
memory/1984-243-0x0000000006F40000-0x0000000006FF4000-memory.dmp
memory/1984-215-0x0000000005E40000-0x0000000005E90000-memory.dmp
memory/1984-244-0x0000000008410000-0x0000000008458000-memory.dmp
memory/1984-245-0x00000000083E0000-0x00000000083F6000-memory.dmp
memory/1984-259-0x0000000000F10000-0x0000000000FC5000-memory.dmp
memory/1984-238-0x0000000006890000-0x0000000006C38000-memory.dmp
memory/1984-246-0x0000000008400000-0x0000000008410000-memory.dmp
memory/1984-237-0x00000000061C0000-0x00000000061D6000-memory.dmp
memory/1984-249-0x00000000085E0000-0x0000000008694000-memory.dmp
memory/1984-248-0x00000000084E0000-0x0000000008514000-memory.dmp
memory/1984-250-0x00000000084A0000-0x00000000084C0000-memory.dmp
memory/1984-251-0x000000000C870000-0x000000000C8D0000-memory.dmp
memory/2840-158-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/2840-159-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/2840-160-0x0000000077BE0000-0x0000000077BF0000-memory.dmp
memory/3076-164-0x0000000077C10000-0x0000000077C20000-memory.dmp
memory/3076-165-0x0000000077C10000-0x0000000077C20000-memory.dmp
memory/3076-163-0x0000000077C10000-0x0000000077C20000-memory.dmp
memory/5792-81-0x00000000064B0000-0x0000000006516000-memory.dmp
memory/5792-95-0x0000000008390000-0x00000000083D8000-memory.dmp
memory/5792-130-0x000000000C7B0000-0x000000000C7EE000-memory.dmp
memory/5792-131-0x000000000C780000-0x000000000C78E000-memory.dmp
memory/5792-129-0x000000000C620000-0x000000000C628000-memory.dmp
memory/5792-126-0x000000000C6E0000-0x000000000C720000-memory.dmp
memory/5792-120-0x000000000C640000-0x000000000C6D2000-memory.dmp
memory/5792-115-0x0000000008660000-0x0000000008714000-memory.dmp
memory/5792-119-0x0000000008540000-0x0000000008560000-memory.dmp
memory/5792-111-0x0000000008560000-0x0000000008594000-memory.dmp
memory/5792-103-0x0000000007090000-0x00000000070A0000-memory.dmp
memory/5792-107-0x0000000008500000-0x000000000851C000-memory.dmp
memory/5792-99-0x00000000070A0000-0x00000000070B6000-memory.dmp
memory/5792-132-0x0000000000E40000-0x0000000000EE7000-memory.dmp
memory/5792-90-0x0000000006DB0000-0x0000000006E5C000-memory.dmp
memory/5792-86-0x0000000006CE0000-0x0000000006CF2000-memory.dmp
memory/5792-82-0x00000000070D0000-0x000000000768A000-memory.dmp
memory/5792-40-0x0000000003760000-0x000000000376E000-memory.dmp
memory/5792-80-0x00000000067A0000-0x0000000006B0A000-memory.dmp
memory/5792-76-0x0000000006110000-0x0000000006126000-memory.dmp
memory/5792-72-0x0000000005F50000-0x0000000005FAA000-memory.dmp
memory/5792-47-0x0000000005DA0000-0x0000000005DEA000-memory.dmp
memory/5840-0-0x0000000077BF0000-0x0000000077C00000-memory.dmp
memory/5840-1-0x0000000077BF0000-0x0000000077C00000-memory.dmp
memory/5840-2-0x0000000077BF0000-0x0000000077C00000-memory.dmp
memory/6024-4-0x0000000077C00000-0x0000000077C10000-memory.dmp
memory/6024-6-0x0000000077C00000-0x0000000077C10000-memory.dmp
memory/6024-5-0x0000000077C00000-0x0000000077C10000-memory.dmp