8edb816fad5bc8fce1ac93b64398f7187d3074313f6c7734a51dd85200fe3a02

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ដំណឹងជ្រើសរើសបុគ្គលិកផ្នែកហិរញ្ញវ�.exe
Size 2.4MB
Sample260907-sdjx1axwas
SHA256 8edb816fad5bc8fce1ac93b64398f7187d3074313f6c7734a51dd85200fe3a02
MD5 6a9206f1860ee5a05c112ce843d4e506
SHA1 d2c3d56b7d5cb70cc2b459b0563f93c984573dc1
SHA512 d9d5bebc4768dc83d2948da859114d249188bd33460fde1693b753b9d90c6dd5832df623fe0d514a9573ee482803bb70f8faf65ac8de00b3df2c1bc76f2d1b2e
SSDEEP 24576:eCvnXZkdlwP4aHHjnNIkG889X4asVrvcEvsjpSVaEmbSQgJeAbhe0:eCvpkdlPIHjc9X4asVrvj0jApmL4
TLSH
T1F6C52803709540AEE41A98BA474A8131E9B07CD517B5E2CF1A90B71F0EF77E41A3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3292	Setp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 3292	6076	ដំណឹងជ្រើសរើសបុគ្គលិកផ្នែកហិរញ្ញវ�.exe	90

C:\Users\Admin\AppData\Local\Temp\ដំណឹងជ្រើសរើសបុគ្គលិកផ្នែកហិរញ្ញវ�.exe
"C:\Users\Admin\AppData\Local\Temp\ដំណឹងជ្រើសរើសបុគ្គលិកផ្នែកហិរញ្ញវ�.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6076
- C:\ProgramLog\Windows\AppData\Log\Setp.exe
  "C:\ProgramLog\Windows\AppData\Log\Setp.exe"
  2⤵
  - Executes dropped EXE
  PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setp.exe

Path C:\ProgramLog\Windows\AppData\Log\Setp.exe
Size 2.4MB
SHA256 8edb816fad5bc8fce1ac93b64398f7187d3074313f6c7734a51dd85200fe3a02
MD5 6a9206f1860ee5a05c112ce843d4e506
SHA1 d2c3d56b7d5cb70cc2b459b0563f93c984573dc1
SHA512 d9d5bebc4768dc83d2948da859114d249188bd33460fde1693b753b9d90c6dd5832df623fe0d514a9573ee482803bb70f8faf65ac8de00b3df2c1bc76f2d1b2e
SSDEEP 24576:eCvnXZkdlwP4aHHjnNIkG889X4asVrvcEvsjpSVaEmbSQgJeAbhe0:eCvpkdlPIHjc9X4asVrvj0jApmL4
TLSH
T1F6C52803709540AEE41A98BA474A8131E9B07CD517B5E2CF1A90B71F0EF77E41A3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download