111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288

Analysis

max time kernel
300s
max time network
323s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Oneshot/_Redist/dxwebsetup.exe
Size 281KB
Sample261023-3sr72adh38
SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
MD5 fd6057b33e15a553ddc5d9873723ce8f
SHA1 f90efb623b5abea70af63c470daa8674444fb1df
SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
TLSH
T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5040	dxwsetup.exe

Loads dropped DLL 2 IoCs

pid	Process
5040	dxwsetup.exe
5040	dxwsetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET1880.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET1880.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SET1890.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SET1890.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DXError.log	dxwsetup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 5040	5028	dxwebsetup.exe	82

C:\Users\Admin\AppData\Local\Temp\Oneshot\_Redist\dxwebsetup.exe
"C:\Users\Admin\AppData\Local\Temp\Oneshot\_Redist\dxwebsetup.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Size 87KB
SHA256 8f2c455c9271290dcde2f68589cf825f9134beecb7e8b7e2ecbcabeab792280a
MD5 0a23038ea472ffc938366ef4099d6635
SHA1 6499d741776dc4a446c22ea11085842155b34176
SHA512 dcc1c2ea86fd3a7870cd0369fa42f63d493895c546dcdd492ee19079a0d0696d689bbfe7b686d4fa549841896a54e673fc4581b80783d7aa255dfad765b9dc88
SSDEEP 1536:gtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCL:gtAvG5mOEll4Roi2pVVFKJuTVtXVpS9y
TLSH
T1E1937D2176A4C176D4D7207875ACA37216BEB5B10BB880CBBB4617E9DC713C1AE3931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup32.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
Size 1.7MB
SHA256 d7ea3cf1b9b639010005e503877026597a743d1068ae6a453ce77cc202796fea
MD5 7672509436485121135c2a0e30b9e9ff
SHA1 f557022a9f42fe1303078093e389f21fb693c959
SHA512 e46ff68c4a532017f8ab15b1e46565508f6285b72c7a1cbe964ed5e75320c8e14587d01fee61b3966f43636bfe74cebd21f7665b4a726281e771cf9230e69863
SSDEEP 49152:RjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWI:5IjmY
TLSH
T17B859E31B1D40332EA7203B177118AB7F63EEB9DE119D565B9AE825920C2B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxwsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
Size 487KB
SHA256 d298fd82a39b2385a742ba1992466e081bea0f49e19ece6b2c87c7c262e1fcee
MD5 eaa6b5ee297982a6a396354814006761
SHA1 780bf9a61c080a335e8712c5544fcbf9c7bdcd72
SHA512 ebdc887b6b334b7560f85ab2ebd29dc1f3a2dedac7f70042594f2a9bc128b6fca0a0e7704318ed69b7acf097e962533b3ce07713ef80e8acfe09374c13302999
SSDEEP 3072:yiqLKTd9mKfwm7rfrK7iPG6rG3C7hO4YTYHVzoPD+sUn7RG+hPXzNbgC1Adm2exP:6kvS4c3C7iMw70
TLSH
T13FB4C05032F4D925F2F32B743AB9E26159BA7E90A938C24D3502525D1BF3B40A96CF37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxwsetup.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
Size 477B
SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
MD5 ad8982eaa02c7ad4d7cdcbc248caa941
SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
TLSH
T191F05C5F6D438D0C30A535207AA346CBFF4C107051C5A08EB54DE05A87E87AD49AC0FF
MD5 SHA1 SHA512 TLSH

Submit Download

DXError.log

Path C:\Windows\Logs\DXError.log
Size 610B
SHA256 399fd44e8131221518159fc91b2f6231b38ddb71a1af149acfd7ab89b8f95b20
MD5 6e97066588a91c7a2829cb12ff11a8ab
SHA1 bfa06af796e01ef021049a3ed9f5dc3eed3b55ff
SHA512 52fb455d7e40427a3cda7fb169fdd4b29f93a1995398f7f954c317eb4116d9c82f19b5460cad67990474a2095d9a9dde9976d7ffce9498ae3ad160196c3ae2c6
TLSH
T122F07DB80C4AB114A153E054F9573356FF800043D81485787565411D49FCC1D3AFF458
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 856B
SHA256 5fb00f5533665cf2cf8f729020e8fc2b87670284f2f2efb215e74d93acda3484
MD5 ae5a15008fc42d6da10c66300e026ac6
SHA1 1951dffb3c6a6bde73e2f94ac3d5e54311ca4bea
SHA512 8bd54cac45ecff7c65492b6bc3beb24dc8639b33dfbc10a4880afeca2d21d92bf12168b2f02a06de2a61fe3521417fd55229cd2629acc94cccd272200fe7fba8
TLSH
T1571170CC2EBB94A578A14A00893F31603E9479972290197C176951AE6921F4DBFCF43D
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 1KB
SHA256 a944552a8505aa5d3671e4e390948c5b237be295df7aeb5015174427cc407067
MD5 ede6f6182aa7abbbab20febbbbe0b1d6
SHA1 6c3a2c9e9163ad88346fc872686074dc20ea0af9
SHA512 8977eeee6329aafa0f8710c51314649a2e3ca52937d966b9e77ccc50d2c0ec0c441744dedfdebc2f822bf1b0109edd44cb40887f08d2605f090d290acb647e3b
TLSH
T1C4212BCC2EBB986A74625741D52F32207E98789712600C7C2765816E5931F5DBFEF43C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads