Analysis
- user interaction
yes - max time kernel
156s - max time network
194s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 21:02
General
- Target Setup.exe
- Size 577.2MB
- Sample261014-zvp9nsstdv
- SHA256 a5b6d7b12479e0c175fb333ccc22397fe5a2e5be32af6d4ea1319f3fc6835b44
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-35RE6.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-35RE6.tmp\Setup.tmp" /SL5="$400A8,599637750,135168,C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 8003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 8003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6088 -ip 60881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6088 -ip 60881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Setup.tmp
memory/4608-0-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4608-69-0x0000000000400000-0x000000000042B000-memory.dmp
memory/6088-6-0x0000000001160000-0x0000000001161000-memory.dmp
memory/6088-7-0x00000000039B0000-0x00000000039B1000-memory.dmp
memory/6088-11-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-9-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-39-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-67-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-66-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-63-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-65-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-62-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-60-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-59-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-68-0x0000000000400000-0x000000000092C000-memory.dmp
memory/6088-56-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-57-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-54-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-53-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-51-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-50-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-48-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-47-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-45-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-44-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-42-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-41-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-38-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-36-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-35-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-32-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-33-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-30-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-29-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-27-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-26-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-24-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-64-0x00000000041F0000-0x00000000041F1000-memory.dmp
memory/6088-61-0x00000000041E0000-0x00000000041E1000-memory.dmp
memory/6088-58-0x00000000041D0000-0x00000000041D1000-memory.dmp
memory/6088-21-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-40-0x0000000004070000-0x0000000004071000-memory.dmp
memory/6088-20-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-18-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-17-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-15-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-14-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-37-0x0000000004060000-0x0000000004061000-memory.dmp
memory/6088-31-0x0000000004040000-0x0000000004041000-memory.dmp
memory/6088-28-0x0000000003A20000-0x0000000003A21000-memory.dmp
memory/6088-25-0x0000000003A10000-0x0000000003A11000-memory.dmp
memory/6088-23-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-55-0x00000000041C0000-0x00000000041C1000-memory.dmp
memory/6088-52-0x00000000041B0000-0x00000000041B1000-memory.dmp
memory/6088-49-0x00000000041A0000-0x00000000041A1000-memory.dmp
memory/6088-22-0x0000000003A00000-0x0000000003A01000-memory.dmp
memory/6088-46-0x0000000004190000-0x0000000004191000-memory.dmp
memory/6088-43-0x0000000004180000-0x0000000004181000-memory.dmp
memory/6088-19-0x00000000039F0000-0x00000000039F1000-memory.dmp
memory/6088-16-0x00000000039E0000-0x00000000039E1000-memory.dmp
memory/6088-13-0x00000000039D0000-0x00000000039D1000-memory.dmp
memory/6088-12-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-10-0x00000000039C0000-0x00000000039C1000-memory.dmp
memory/6088-8-0x0000000002930000-0x0000000002A70000-memory.dmp
memory/6088-34-0x0000000004050000-0x0000000004051000-memory.dmp