2194cf063e5c2659f8e9f91129b45065ca28b8e631e3ec29626827268409941e

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 665KB
Sample260724-pf2daazckh
SHA256 2194cf063e5c2659f8e9f91129b45065ca28b8e631e3ec29626827268409941e
MD5 4db2da78f91c543d4bd3aba6eae1f116
SHA1 62d99537a04e0b2af436f14bf5ff47d9a51d8a7a
SHA512 3fbab6604c6a3d3becc06aea0ba32cc4314f4af4c53aef520343abc08fce88a6d76d07e47dbeb5857f94af28649bbdc2b38ae88be6b32ba2f94828458f0d9b19
SSDEEP 12288:sm/fX9rhmsdW5jivju3w1SC4LqwRlFeMb01JQntLOC+ta8SQW:P/P9wsdWt4Cw4xL/em+k8P
TLSH
T163E4F51366DCBCA8E0725270AB7797D1D77EFC201B20C68F22D045596A3D9C2BE31B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4128	NetCoreCheck.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4128	4256	setup.exe	89

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\VSD577D.tmp\net8desktopruntime_x64\NetCoreCheck.exe
  "C:\Users\Admin\AppData\Local\Temp\VSD577D.tmp\net8desktopruntime_x64\NetCoreCheck.exe" Microsoft.WindowsDesktop.App 8.0.18
  2⤵
  - Executes dropped EXE
  PID:4128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetCoreCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\VSD577D.tmp\net8desktopruntime_x64\NetCoreCheck.exe
Size 141KB
SHA256 3e1c1d8c5540e45099a501c4bc910222618fc21563644bc9add00ea541b013f9
MD5 f0cb8c49b000d90dd2f181affbf2b4e0
SHA1 4e5477e508329be2d65666669e87e5cc941bd268
SHA512 af8b064216dd13b5e45aff330da1292d06498e6f37b04c7583f7e0badd635acac9a5750d94e6565537f8899dc80b4184f0fa040210688d508764607cc5768586
SSDEEP 3072:aBV7jm3iLBn9EDTvuy0bbfu89kMpk1CeA1tTl:aVca8s3
TLSH
T1E9E34A07B3AC20E8E1B6D238C9A18502E77678B54B729BCF0360865E1F677D0DE79761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download