Resubmissions
08/08/2026, 01:16
260808-bm3yssba48708/08/2026, 01:03
260808-beldsafj2v1008/08/2026, 00:50
260808-a68sqaztaz10Analysis
- user interaction
yes - max time kernel
44s - max time network
48s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 01:16
Errors
General
- Target setup.exe
- Size 90.0MB
- Sample260808-bm3yssba48
- SHA256 16637168f9d85bb5abe9dbcd2586ee859fd2981e7ea173c031e0cf3bf0ee4da8
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 18 IoCs
- Suspicious use of SendNotifyMessage 17 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Rebate.png2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set DsdfUDkcJfTAYMDOWpDWeLveX=AutoIt3.exe & Set SskySwJYfWEwAyf=.a3x & Set VFDoZKCNGBINaCP=3004⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y Surgeons.png *.*4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "Martial" Orchestra4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\43013\Graphics.comGraphics.com l4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ResolveCheckpoint.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39bc055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Graphics.com
l
Cab.png
Captured
Cm
Cross
Orchestra
Porsche.png
Product
Prompt
Publish
Rebate.png
Recorded.png
Routine.png
Street
Surgeons.png
Utils.png
Wallpapers
nsExec.dll
memory/744-84-0x00007FFFE8640000-0x00007FFFE8654000-memory.dmp
memory/744-96-0x00007FFFE7AA0000-0x00007FFFE7ACD000-memory.dmp
memory/744-117-0x00007FFFE8660000-0x00007FFFE8694000-memory.dmp
memory/744-76-0x00007FF730930000-0x00007FF730A28000-memory.dmp
memory/744-77-0x00007FFFE8660000-0x00007FFFE8694000-memory.dmp
memory/744-81-0x00007FFFEFD10000-0x00007FFFEFD32000-memory.dmp
memory/744-82-0x00007FFFEEA50000-0x00007FFFEEA7B000-memory.dmp
memory/744-80-0x00007FFFF5560000-0x00007FFFF5579000-memory.dmp
memory/744-79-0x00007FFFF66F0000-0x00007FFFF6701000-memory.dmp
memory/744-118-0x00007FFFE6240000-0x00007FFFE64F6000-memory.dmp
memory/744-116-0x00007FF730930000-0x00007FF730A28000-memory.dmp
memory/744-86-0x00007FFFE8540000-0x00007FFFE8612000-memory.dmp
memory/744-78-0x00007FFFE6240000-0x00007FFFE64F6000-memory.dmp
memory/744-85-0x00007FFFE8620000-0x00007FFFE8631000-memory.dmp
memory/744-83-0x00007FFFE5560000-0x00007FFFE58F0000-memory.dmp
memory/744-104-0x00007FFFE4CE0000-0x00007FFFE4D8B000-memory.dmp
memory/744-100-0x00007FFFE4EB0000-0x00007FFFE50BB000-memory.dmp
memory/744-106-0x00007FFFE4CA0000-0x00007FFFE4CB2000-memory.dmp
memory/744-107-0x00007FFFDE2F0000-0x00007FFFDE535000-memory.dmp
memory/744-105-0x00007FFFE4CC0000-0x00007FFFE4CDB000-memory.dmp
memory/744-89-0x00007FFFE51D0000-0x00007FFFE52B8000-memory.dmp
memory/744-103-0x00007FFFE4D90000-0x00007FFFE4DB5000-memory.dmp
memory/744-102-0x00007FFFE4DC0000-0x00007FFFE4E0F000-memory.dmp
memory/744-101-0x00007FFFE4E10000-0x00007FFFE4EA8000-memory.dmp
memory/744-87-0x00007FFFE52C0000-0x00007FFFE5556000-memory.dmp
memory/744-99-0x00007FFFE50C0000-0x00007FFFE50D1000-memory.dmp
memory/744-98-0x00007FFFE7A60000-0x00007FFFE7A71000-memory.dmp
memory/744-97-0x00007FFFE7A80000-0x00007FFFE7A9A000-memory.dmp
memory/744-91-0x00007FFFE50E0000-0x00007FFFE51C3000-memory.dmp
memory/744-95-0x00007FFFE7AD0000-0x00007FFFE7AF6000-memory.dmp
memory/744-94-0x00007FFFE7B00000-0x00007FFFE7B18000-memory.dmp
memory/744-93-0x00007FFFE84C0000-0x00007FFFE84EF000-memory.dmp
memory/744-92-0x00007FFFE84F0000-0x00007FFFE8531000-memory.dmp
memory/2080-74-0x0000000004BE0000-0x0000000004C75000-memory.dmp
memory/2080-90-0x0000000004BE0000-0x0000000004C75000-memory.dmp
memory/2080-88-0x0000000004BE0000-0x0000000004C75000-memory.dmp
memory/2080-75-0x0000000004BE0000-0x0000000004C75000-memory.dmp
memory/2080-73-0x0000000004BE0000-0x0000000004C75000-memory.dmp