Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 03:02
General
- Target GTKSetup-en.exe
- Size 1.1MB
- Sample260730-djkddsah36
- SHA256 94a902e2cc63b32a80d7e822821775a7484e0dd518a3fcd3c1531346c723cf17
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 1 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 37 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTKSetup-en.exe"C:\Users\Admin\AppData\Local\Temp\GTKSetup-en.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Trojan Killer\tk.exe"C:\Program Files\Trojan Killer\tk.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Trojan Killer\tk64.exe"C:\Program Files\Trojan Killer\tk64.exe"3⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
7z64.dll
upd104.c
libeay64.dll
libmem64.dll
offreg64.dll
ssleay64.dll
tk.exe
tk.ini
tk.ini
tk64.exe
EA618097E393409AFA316F0F87E2C202_23600236062AAB35C63836C40B6D2700
EA618097E393409AFA316F0F87E2C202_23600236062AAB35C63836C40B6D2700
szo6gZa1.0Mv
Reset Browser Settings.lnk
Trojan Killer.lnk
7z32.dll
libeay86.dll
libmem32.dll
offreg32.dll
ssleay86.dll
tk32.exe
memory/1112-145-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-118-0x000000000B300000-0x000000000B517000-memory.dmp
memory/1112-206-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-158-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-159-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-162-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-149-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-169-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-131-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/1112-132-0x0000000000400000-0x0000000001D53000-memory.dmp
memory/4184-20-0x0000000000400000-0x0000000000735000-memory.dmp
memory/4184-4-0x0000000002660000-0x0000000002661000-memory.dmp
memory/4184-0-0x0000000000400000-0x0000000000735000-memory.dmp
memory/4184-98-0x0000000000400000-0x0000000000735000-memory.dmp
memory/4184-2-0x0000000000400000-0x0000000000735000-memory.dmp
memory/4184-1-0x0000000002660000-0x0000000002661000-memory.dmp
memory/4184-89-0x0000000000400000-0x0000000000735000-memory.dmp
memory/4252-101-0x0000000000400000-0x000000000058A000-memory.dmp