Overview
overview
7Static
static
3setup.exe
windows10-2004-x64
7setup.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ze.dll
windows10-2004-x64
3$PLUGINSDI...ze.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...om.dll
windows10-2004-x64
3$PLUGINSDI...om.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...��.exe
windows10-2004-x64
3$PLUGINSDI...��.exe
windows11-ltsc_2024-x64
3SdActi.exe
windows10-2004-x64
7SdActi.exe
windows11-ltsc_2024-x64
7SdActiRc.dll
windows10-2004-x64
1SdActiRc.dll
windows11-ltsc_2024-x64
1SdRuntimeInstall.exe
windows10-2004-x64
7SdRuntimeInstall.exe
windows11-ltsc_2024-x64
7SupportTools.exe
windows10-2004-x64
7SupportTools.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
150s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 19:40
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CopyFiles.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/CopyFiles.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/GetHexFileSize.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/GetHexFileSize.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LaunchCustom.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LaunchCustom.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Rm PurelyKissׂẴ[UpɃCXg[.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Rm PurelyKissׂẴ[UpɃCXg[.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
SdActi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
SdActi.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
SdActiRc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
SdActiRc.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
SdRuntimeInstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
SdRuntimeInstall.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
SupportTools.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
SupportTools.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/DiagSummary.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/DiagSummary.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
General
- Target setup.exe
- Size 9.4MB
- Sample260814-ydhylagp21
- SHA256 2e2a408438bccad5ecdac5e4b1e2278df494a4060e19b30bebcf09a69f3aafce
- MD5 49b14ae2022b9393e480fa31243b3a39
- SHA1 cc215ca9f526fae731f0a7420af80b2dc23cbf74
- SHA512 8a9479061355753401ec99f685eaef41dd8304b52607701d541860b04af8ac56d4297ea12284534add861691ecf65c82448bfb39f948db123989b40d1b2a6337
- SSDEEP 196608:/IGe3Q6MRAjLs+wpSp+KMEUd/ZHMQJBnF36YBDh2VWid2qHtU:/ceuLo1dRs0nplBY2qHm
- TLSH T139A633B0234580E2D5E1BEB187B8092F63B7479C972A3E721BB128E715648D199F335F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 21 IoCs
pid Process 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe 3228 setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\GetHexFileSize.dll
- Size 56KB
- SHA256 8783fc24f26a40f506f91205a948cd93723e98fae009f742309304aedca69f4c
- MD5 73fae12a21d8298640bb18adbc94c6af
- SHA1 f7fc691bb2350b70b707289df762860535b7fbe0
- SHA512 f5acc2f5243fd23b401624f9094661748001b97dfe32d8341827f33fbb1ac7fab695bea55f5c58845157b9da00ead41afde7059a8d385acce4efe3cf613c286d
- SSDEEP 768:AGfL4oIJU7T+T+xp+dT8hwavNSjtvsUVT/lT+:AGflH+TUgwhutvPRlT
- TLSH T104438E1134D280F3CB8D413455A26F2EA7BEB9505FE55A83AFB0979E6E319E0C13B316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- TLSH T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\saveplace.ini
- Size 945B
- SHA256 8634a470484a47c33d78caa8c697859ac0010c8f09fa134aa0486df385509d8f
- MD5 a3564e3326d6906664395f17c2988d22
- SHA1 63c053cf98b7b97c9e94bc9cf7ae59af5af5a40f
- SHA512 c867cab4bf13fd29cbf1abbb2cf266900524d53c48f114733f4c79128cebba551bec0b91d8f4e1e849d55012b8686fa96295df887e8ad369730d6ce7f60f6f00
- TLSH T1B21152D88410822E84217541347F796BABF45C381B497DA8F2750C83D74CEE25CDC5C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\saveplace.ini
- Size 1023B
- SHA256 a99d2a00d2752b7b45e009395608115d383f6816f3e9dd4b183d8ed89325da27
- MD5 e938142a9d1a2f37723a058aa24cbc21
- SHA1 31080a24d8130218f5541e6c40c4995adcd6b9f3
- SHA512 cd5c5790aeb31ddb3b2663185554be1693dfa3af19f91fab1259cf4a17de819ea212fe02603a2b92e99210a059914ba229cfac29cda2653c83553aff3e8fa18a
- TLSH T1FA1150988420836A8425718125BF7967BBE45C382B4D3DA8F2750C83D79CDE39C9C5C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\saveplace.ini
- Size 1KB
- SHA256 f9643b95b8c2347fea5b521ad674b0535845321c9913f5c6c29050c7263ad3ab
- MD5 dd0eb1be810d4f2dbc06ac1530b43748
- SHA1 f8d36883b6f3ab296c3ead83bf47955d6da15f57
- SHA512 465dbe68e3dadac0f5f15fe3b975848b7b5fd32903e6836bd6ecbaf8186e1f8b4e18102f5574c49568cf082ec9cd10e4cde134fa056d40f5046c32930a0be80c
- TLSH T1651150988420836A8425718125BF7967BBE45D382B4D3DA8F2750CC3D79DEE29CDC9C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf42EC.tmp\saveplace.ini
- Size 726B
- SHA256 847b3eb8b8d6b4bc49b3187705b40b2f8855daa9179c3ae1a39a39415a6d97e5
- MD5 a207428077c788cbb01bc176443aac5b
- SHA1 c8306af845c737d574818bc13540599722293851
- SHA512 5252d82912cc6d2c9ef9e0a7294e4103945a661e59e544a658fddecc045c76a40d9d223a253d2210b99da2a00be33691dfacb63e5ef20a0a81ac107bd6bc98ab
- TLSH T1C501DDD88410837A8431A541687F79A76BE06D382F493DB8F2750C93D78DEE25CDC6C9
- MD5 SHA1 SHA512 TLSH