e3810832e1aa597c891e5805fd6ce82657897d199f48d87b52e35a247ae3e713

Analysis

user interaction
yes
max time kernel
152s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 165.1MB
Sample260828-snkbhsdd83
SHA256 e3810832e1aa597c891e5805fd6ce82657897d199f48d87b52e35a247ae3e713
MD5 42b973bf15e812c3783c24550141378b
SHA1 eb1815cb14a57368eaa8d1224bc6bacd7c3b1551
SHA512 d04e677e55e2ab99ef55a6b5c1197028aec882f8b8da4741e7fdf7464631e291757ba251a0452919015769063bce19393a6f9d572a49c88cd85ab6b593ddfee3
SSDEEP 786432:A46ysID6qcmT97O4O4AlvhUV5OtsFctafjbSsDciF3p5mh/sm0VydLmYETjH:WQD6q9O4pA9hUia3Ss4i1p5IURdYSjH
TLSH
T10B888D11A3E81A45E27B8278D77382A1E6B1BC535711C1CF0094FA5A2F77BC1BA36376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2984	Setup.exe
2984	Setup.exe
2984	Setup.exe
2984	Setup.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4760	sc.exe
672	sc.exe
2568	sc.exe
5584	sc.exe
1788	sc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2984	Setup.exe
2984	Setup.exe
2984	Setup.exe
2984	Setup.exe
2984	Setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	Setup.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2568	2984	Setup.exe	89
PID 2984 wrote to memory of 5584	2984	Setup.exe	93
PID 2984 wrote to memory of 1788	2984	Setup.exe	95
PID 2984 wrote to memory of 4760	2984	Setup.exe	98
PID 2984 wrote to memory of 672	2984	Setup.exe	100

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SYSTEM32\sc.exe
  "sc" stop MullvadVPN
  2⤵
  - Launches sc.exe
  PID:2568
- C:\Windows\SYSTEM32\sc.exe
  "sc" stop MullvadVPN
  2⤵
  - Launches sc.exe
  PID:5584
- C:\Windows\SYSTEM32\sc.exe
  "sc" stop MullvadVPN
  2⤵
  - Launches sc.exe
  PID:1788
- C:\Windows\SYSTEM32\sc.exe
  "sc" stop MullvadVPN
  2⤵
  - Launches sc.exe
  PID:4760
- C:\Windows\SYSTEM32\sc.exe
  "sc" stop MullvadVPN
  2⤵
  - Launches sc.exe
  PID:672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Setup\bcuq0dllTHcv\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Setup\bcuq0dllTHcv\PresentationNative_cor3.dll
Size 1.2MB
SHA256 75fc0d383ea009ea9453a4589fa8d88d149abcac371bb5eb983d6ece8f1243eb
MD5 a5e9f16c6a381a2241bef8eed1c20309
SHA1 574d1412c55cb2321d2d6545cbb439368623e2a5
SHA512 d9509720807f9298caa1af3abbb098348726700815559febd3417d929e57c7839f498391e92e2a02d8c984db9bf786d25170471fea71bc64c9329b29242244e7
SSDEEP 24576:Tl8W6eU6UPXhA+JYCqX4T3MJj7OQ1Niqdhvc7PgNfb4i7fokJMpw5i2k1/m6eg9k:TH6emPXrYCqX4T3Q1Niqzc74xb4izMp7
TLSH
T118453A22D2E642E4C47FC1B8C646972BFBB17409231C66DB47608B652F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Setup\bcuq0dllTHcv\vcruntime140_cor3.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Setup\bcuq0dllTHcv\wpfgfx_cor3.dll
Size 1.9MB
SHA256 1ccb4943ef0d472d70e1cb4738f89fb457010e12fa82379daf2dc64cf59d6e9b
MD5 62585acd299185da1f109f935b4320ed
SHA1 6f51669ac4581d6f6e58b99f4a2f6d5ee9e55b6c
SHA512 cf7aee56e1443292b8f71c050a78849f663e8d0be492678f7ea74d5b1f62f12782044bf9ea8469434b15360c8e7eba670bf5a78af7c14b718ad5cb641aade38c
SSDEEP 24576:fp3YLMLrT18UP2HTePBDpuZiV1/QcqylsQdS/etT4ZdSAcMGuOk8SlXlTm:am3iUP2HKBDpuSUypM2tWdSAc5uOq5s
TLSH
T1B8953A46B6EC40EAD47AE23CD9D7461BF27278142761A7CF23A0479D6F27BD0097A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download