6569e21744a4f1d363c1a393ad75471072c8a17740b08c202b66af0a92cf961a

Analysis

max time kernel
298s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 22.0MB
Sample260802-qnvq5stdre
SHA256 6569e21744a4f1d363c1a393ad75471072c8a17740b08c202b66af0a92cf961a
MD5 3f7e9b7820cac7f9ac66585305963e37
SHA1 dd7b5e35a5cb5aeb89d1e91ae7e6b2bfa1d3b01c
SHA512 bd2b89869338931b417bc16dbf805420fc6147952378073d64f44ebdf81ff65cfc8127c0a5fd57b873eb28bc93b71fbabc267d71b7c7a00c9f5de65ff492c52d
SSDEEP 49152:NdTeiaHKGz7VOfbNfwejyvkMz7X4zeE+xoSITAd0AM3ejTDt:ToKYVOfhfZiJzE+gAuAM3ejV
TLSH
T10F37332253D20661F87A1B7964F910339134BCD6CFAA82EF73E49ACB1E73A569435307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4608	AutoIt3.exe

Executes dropped EXE 2 IoCs

pid	Process
4608	AutoIt3.exe
4920	AutoIt3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4920	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4608 set thread context of 4920	4608	AutoIt3.exe	84

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe
4920	AutoIt3.exe
4920	AutoIt3.exe
4920	AutoIt3.exe
4920	AutoIt3.exe
4920	AutoIt3.exe
4920	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4608	AutoIt3.exe
4608	AutoIt3.exe
4608	AutoIt3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4608	4716	Setup.exe	82
PID 4608 wrote to memory of 4920	4608	AutoIt3.exe	84
PID 4608 wrote to memory of 4920	4608	AutoIt3.exe	84
PID 4608 wrote to memory of 4920	4608	AutoIt3.exe	84

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Spelling.a3x
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spelling.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Spelling.a3x
Size 1.5MB
SHA256 b572daf0af38b0d4715b9f275d3909b9c67ba23b5b46102ab57c1a031b0666ab
MD5 9d1af84a6e1360a83c21b488b892f8af
SHA1 e031d9c1e238c818721bbf8639b2ca57da593ea8
SHA512 e1efe3b78e5fbd2106f090ee81316f9d5c61414927e0420f47f76b6d5eace6f7e120b6eb5014a1b99d24ffd02d9e84cdcbf366e24cb76dd8af83ea39c8d08ecb
SSDEEP 49152:4AjaAZBzmV/8VpSwVaxtkUTSv4b8E+SrSITCD:4mZMV/8jSTLTTL+oCD
TLSH
T12975333575534F35AF652AEBB01C3026920D16E9CFCB4569F9B99FD708F1B3AA0A80C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4608-7-0x00007FFA9DF30000-0x00007FFA9E128000-memory.dmp

Download

memory/4608-8-0x00000238CFD60000-0x00000238CFD61000-memory.dmp

Download

memory/4920-10-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download

memory/4920-11-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download

memory/4920-13-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download

memory/4920-14-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download

memory/4920-15-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download

memory/4920-16-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download

memory/4920-17-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download

memory/4920-18-0x000001CC53CF0000-0x000001CC53F2A000-memory.dmp

Download