Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 22:20
Behavioral task
behavioral1
Sample
setup_lust_epidemic_1.0_(64026).exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target setup_lust_epidemic_1.0_(64026).exe
- Size 2.3MB
- Sample260815-19ebdsvyes
- SHA256 2eb07cf0bfa4d1c864a98384e24a8ad716e3f1816c1dbf2c6211f4e0b6944fe1
- MD5 5aa682ebe18276caafa5be805c265bad
- SHA1 e75dbcb9a1ba499f2669da836bebe29c95fe6b4d
- SHA512 77f9f4774500144c3187a5747648a5903c19d0e8d5588158f75c5d57df197d4e493058515f3b47006ddf8d1ddac1511ead49e0e5176eac3a5a7672924b0396ba
- SSDEEP 49152:sigD49C5hnl1JQ8TyVZNgOKq+v0rwPlptu4JXrMZzQXNu1H8r:AKC5/1JXqaq+MclLXrMZ8XNu1cr
- TLSH T1BBB5DF18EAA65A33D83D0B7654F34E243F34119A17D383720CFAF03C2D767999AB6694
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2720 setup_lust_epidemic_1.0_(64026).tmp - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_lust_epidemic_1.0_(64026).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_lust_epidemic_1.0_(64026).tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/2772-0-0x0000000000B30000-0x0000000000B69000-memory.dmp innosetup behavioral2/memory/2772-8-0x0000000000B30000-0x0000000000B69000-memory.dmp innosetup - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2720 2772 setup_lust_epidemic_1.0_(64026).exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_lust_epidemic_1.0_(64026).exe"C:\Users\Admin\AppData\Local\Temp\setup_lust_epidemic_1.0_(64026).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\is-JKN1N.tmp\setup_lust_epidemic_1.0_(64026).tmp"C:\Users\Admin\AppData\Local\Temp\is-JKN1N.tmp\setup_lust_epidemic_1.0_(64026).tmp" /SL5="$60274,192512,0,C:\Users\Admin\AppData\Local\Temp\setup_lust_epidemic_1.0_(64026).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-JKN1N.tmp\setup_lust_epidemic_1.0_(64026).tmp
- Size 1.3MB
- SHA256 d7f8f29d2178afad9a15f24f40930e889452fbd3ccbe8b57f86a03f555b7a297
- MD5 4dabb086137727aebfdb72f82bc091ba
- SHA1 ed2336a0855a1d07d0e4503c034b42e61369a41d
- SHA512 6813d67def63db5b60584b45fa1c672f83e9ce132f9f4e82a0ac41988c343c3b9e5b23831ddca1f6dbd518935770aca1234567dcf7454be19c910370dd45c009
- SSDEEP 24576:xgNfn7OOXeL7dJ/oOP9pjA0fY2Mqz9JT7ytfsxjHElkLD229Oqkipt1NCnqxjVP:StTX6THjACMq/xCaaMksgil
- TLSH T1A4554A22A3D18437D4732F795D2BD6946C3A7E202EA4A44E7EF89E4C0E35B417D39392
- MD5 SHA1 SHA512 SSDEEP TLSH