Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 17:14
General
- Target OktaVerifySetup-7.1.0.0-831181d.exe
- Size 29.5MB
- Sample261017-vsblaaay6v
- SHA256 6e09b1c12998336d7743290765bfbce8ba11b21b96c90355ad9fdf76b1f6897e
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OktaVerifySetup-7.1.0.0-831181d.exe"C:\Users\Admin\AppData\Local\Temp\OktaVerifySetup-7.1.0.0-831181d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\{C912F21C-9BC8-4973-84EE-E71E0A212843}\.ba\OktaVerifySetupApp.exe"C:\Windows\TEMP\{C912F21C-9BC8-4973-84EE-E71E0A212843}\.ba\OktaVerifySetupApp.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{75C7EC4D-02CF-4766-9932-C3DADDB3D08B} {42BB7F9E-9D97-4B96-BB93-524A7311F330}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.ApplicationInsights.dll
Newtonsoft.Json.dll
Okta.Installer.Foundations.dll
OktaVerifySetupApp.exe.config
System.Diagnostics.DiagnosticSource.dll
WixToolset.BootstrapperApplicationApi.dll
mbanative.dll
OktaVerifySetupApp.exe
memory/3552-35-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-18-0x00007FFE6AA5F000-0x00007FFE6AA60000-memory.dmp
memory/3552-27-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-26-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-29-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-30-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-23-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-31-0x0000017355230000-0x0000017355238000-memory.dmp
memory/3552-21-0x00000173551E0000-0x000001735520E000-memory.dmp
memory/3552-36-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-19-0x0000017353540000-0x0000017353592000-memory.dmp
memory/3552-37-0x000001736DB00000-0x000001736DB32000-memory.dmp
memory/3552-33-0x000001736DA90000-0x000001736DAF2000-memory.dmp
memory/3552-25-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-39-0x000001736DD80000-0x000001736DE30000-memory.dmp
memory/3552-40-0x000001736DB80000-0x000001736DBA2000-memory.dmp
memory/3552-41-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-42-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-43-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-44-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp
memory/3552-55-0x000001736EE80000-0x000001736EE88000-memory.dmp
memory/3552-54-0x000001736EE70000-0x000001736EE78000-memory.dmp
memory/3552-57-0x0000017372EF0000-0x0000017372EFE000-memory.dmp
memory/3552-56-0x0000017372F30000-0x0000017372F6E000-memory.dmp
memory/3552-58-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp