Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/07/2026, 22:13
General
- Target Claude Setup.exe
- Size 13.1MB
- Sample260726-142jqsstdw
- SHA256 80e5c9896391451b433684243b2a4e4b9e15eda43021a8e65eec26d10c208644
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"C:\Users\Admin\AppData\Local\Temp\Claude Setup.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_ctypes.pyd
_hashlib.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
python314.dll
memory/4960-47-0x00007FFF64100000-0x00007FFF64114000-memory.dmp
memory/4960-36-0x00007FFF4B770000-0x00007FFF4BE7D000-memory.dmp
memory/4960-43-0x00007FFF65FE0000-0x00007FFF65FEF000-memory.dmp
memory/4960-41-0x00007FFF64120000-0x00007FFF64149000-memory.dmp
memory/4960-49-0x00007FFF4B130000-0x00007FFF4B761000-memory.dmp
memory/4960-50-0x00007FFF4B770000-0x00007FFF4BE7D000-memory.dmp
memory/4960-51-0x00007FFF64120000-0x00007FFF64149000-memory.dmp
memory/4960-55-0x00007FFF64100000-0x00007FFF64114000-memory.dmp
memory/4960-54-0x00007FFF65FE0000-0x00007FFF65FEF000-memory.dmp
memory/4960-56-0x00007FFF4B130000-0x00007FFF4B761000-memory.dmp
memory/4960-57-0x00007FFF4B770000-0x00007FFF4BE7D000-memory.dmp
memory/4960-53-0x00007FFF64120000-0x00007FFF64149000-memory.dmp