Overview

overview

4

Static

static

1

TableauDes...1).exe

windows10-2004-x64

4

TableauDes...1).exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    154s
  • max time network
    170s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 01:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TableauDesktop-64bit-2026-2-1 (1).exe
  • Size 708.4MB
  • Sample260930-bsw3fa1y7m
  • SHA256 4047f655fa01659f7bd55f1e17fe7e7fa17aa6e86f600d48fb76012b6c29fd7a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TableauDesktop-64bit-2026-2-1 (1).exe
    "C:\Users\Admin\AppData\Local\Temp\TableauDesktop-64bit-2026-2-1 (1).exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\Temp\{78CD1867-58EC-4165-8F25-5664D59EA59E}\.cr\TableauDesktop-64bit-2026-2-1 (1).exe
      "C:\Windows\Temp\{78CD1867-58EC-4165-8F25-5664D59EA59E}\.cr\TableauDesktop-64bit-2026-2-1 (1).exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\TableauDesktop-64bit-2026-2-1 (1).exe" -burn.filehandle.attached=748 -burn.filehandle.self=752
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5260
      • C:\Windows\Temp\{E109B374-E5A2-49B6-8FD8-A4BE3010929D}\.ba\Checkprocessorspecs.exe
        C:\Windows\Temp\{E109B374-E5A2-49B6-8FD8-A4BE3010929D}\.ba\Checkprocessorspecs.exe
        3⤵
        • Executes dropped EXE
        PID:5992

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        TableauDesktop-64bit-2026-2-1 (1).exe
        • Path C:\Windows\Temp\{78CD1867-58EC-4165-8F25-5664D59EA59E}\.cr\TableauDesktop-64bit-2026-2-1 (1).exe
        • Size 1.1MB
        • SHA256 f7f17c47a7bb3f2d8d6aebb4e7b7a9e504f6e353aee26209820843a913193801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Checkprocessorspecs.exe
        • Path C:\Windows\Temp\{E109B374-E5A2-49B6-8FD8-A4BE3010929D}\.ba\Checkprocessorspecs.exe
        • Size 132KB
        • SHA256 75db4370d2ec2b042d1f9bcd48b57b5b8d7f9d11979892606cc99285e7699adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LogoSide.bmp
        • Path C:\Windows\Temp\{E109B374-E5A2-49B6-8FD8-A4BE3010929D}\.ba\LogoSide.bmp
        • Size 7KB
        • SHA256 cbfa590ab2d7a1117ca400faadcda67e9f0c79fd45449998043b8f5d5ab42730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Tableau.png
        • Path C:\Windows\Temp\{E109B374-E5A2-49B6-8FD8-A4BE3010929D}\.ba\Tableau.png
        • Size 19KB
        • SHA256 93027e0d9841e234af2db166b96ca25b1b64c8623cbf920177cf7506a96fb44b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixextba.dll
        • Path C:\Windows\Temp\{E109B374-E5A2-49B6-8FD8-A4BE3010929D}\.ba\wixextba.dll
        • Size 455KB
        • SHA256 64a7217bd26cda90128469025a698c9488b15566041b770331f7210b2616cee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download