Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 10:43
General
- Target startup.exe
- Size 6.7MB
- Sample260820-msfk8scg52
- SHA256 6b812a6e511717e118ffe8d867e7347498b9d5eaf2e8ca075af17e6605b84a79
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 33 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\startup.exe"C:\Users\Admin\AppData\Local\Temp\startup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\D99BD07048C91F11FA9125BAEBDEFC6D\startup.exe"C:\Windows\temp\D99BD07048C91F11FA9125BAEBDEFC6D\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\startup.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\884D247048C91F11FA9125BAEBDEFC6D\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\884D247048C91F11FA9125BAEBDEFC6D\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAAZht5NYnzViDPjtQRaPGPDAvwAAAwQ///IS3EkFw/xMi0AFwAHAEQAbABhAHcAYgB0AGIAZgAAAAcAMQAwAC4AMQAyADcALgAwAC4ANAAAAAAACQD//wAAHgD//wAAEAD//wAACgD//wAAFgD//wAAHwD//wAADgD//wAAAAA=:3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
kl.setup.ui.core.dll
kl.setup.ui.dll
kl.setup.ui.interoplayer.dll
kl.setup.ui.visuals.dll
kl.ui.framework.dll
kl.ui.framework.uikit.b2c.dll
kl.ui.framework.uikit.dll
kl.ui.framework.uikit.media.setup.dll
setup.dll
setup_ui.exe
sharpvectorconverterswpf.dll
sharpvectorcore.dll
sharpvectorcss.dll
sharpvectordom.dll
sharpvectormodel.dll
sharpvectorrenderingwpf.dll
sharpvectorruntimewpf.dll
startup.exe
memory/2060-44-0x00000000729D0000-0x000000007318C000-memory.dmp
memory/2060-111-0x0000000007E80000-0x0000000007E9C000-memory.dmp
memory/2060-75-0x0000000005A40000-0x0000000005AA8000-memory.dmp
memory/2060-83-0x00000000062F0000-0x00000000066C4000-memory.dmp
memory/2060-85-0x0000000006C90000-0x000000000724A000-memory.dmp
memory/2060-84-0x0000000005F80000-0x0000000005FE6000-memory.dmp
memory/2060-86-0x00000000066D0000-0x000000000670E000-memory.dmp
memory/2060-50-0x0000000005870000-0x00000000058C0000-memory.dmp
memory/2060-90-0x00000000068A0000-0x00000000068C6000-memory.dmp
memory/2060-45-0x00000000729D0000-0x000000007318C000-memory.dmp
memory/2060-94-0x0000000006990000-0x0000000006A46000-memory.dmp
memory/2060-134-0x00000000729D0000-0x000000007318C000-memory.dmp
memory/2060-99-0x0000000007EA0000-0x0000000007EE8000-memory.dmp
memory/2060-41-0x00000000017D0000-0x00000000017DE000-memory.dmp
memory/2060-38-0x00000000729E2000-0x00000000729E3000-memory.dmp
memory/2060-103-0x0000000006C70000-0x0000000006C86000-memory.dmp
memory/2060-133-0x00000000729D0000-0x000000007318C000-memory.dmp
memory/2060-79-0x0000000005BF0000-0x0000000005C06000-memory.dmp
memory/2060-132-0x00000000729E2000-0x00000000729E3000-memory.dmp
memory/2060-119-0x0000000008030000-0x00000000080E4000-memory.dmp
memory/2060-131-0x0000000000490000-0x000000000055C000-memory.dmp
memory/2060-123-0x0000000007EF0000-0x0000000007F10000-memory.dmp
memory/2060-115-0x0000000007F30000-0x0000000007F64000-memory.dmp
memory/2060-130-0x000000000C360000-0x000000000C36E000-memory.dmp
memory/2060-107-0x0000000007E50000-0x0000000007E60000-memory.dmp
memory/2060-124-0x000000000C220000-0x000000000C2B2000-memory.dmp
memory/2060-129-0x000000000C210000-0x000000000C218000-memory.dmp
memory/2060-128-0x000000000C2C0000-0x000000000C304000-memory.dmp
memory/3508-1-0x00000000774B0000-0x00000000774C0000-memory.dmp
memory/3508-2-0x00000000774B0000-0x00000000774C0000-memory.dmp
memory/3508-0-0x00000000774B0000-0x00000000774C0000-memory.dmp
memory/4108-6-0x00000000774C0000-0x00000000774D0000-memory.dmp
memory/4108-5-0x00000000774C0000-0x00000000774D0000-memory.dmp
memory/4108-4-0x00000000774C0000-0x00000000774D0000-memory.dmp