Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 03:18
General
- Target Setup_Wizard.V.1.10.exe
- Size 93.4MB
- Sample261027-dtvbcace85
- SHA256 afacd198a4221f3a33c60860bde125a68f4853326e88f9e6bfef4200fdb8295d
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_Wizard.V.1.10.exe"C:\Users\Admin\AppData\Local\Temp\Setup_Wizard.V.1.10.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/3208-0-0x000001BECFC42000-0x000001BECFC43000-memory.dmp
memory/3208-1-0x000001BECFC40000-0x000001BECFC41000-memory.dmp
memory/3208-3-0x000001BECFC43000-0x000001BECFC44000-memory.dmp
memory/3208-7-0x000001BECFC47000-0x000001BECFC48000-memory.dmp
memory/3208-6-0x000001BECFC46000-0x000001BECFC47000-memory.dmp
memory/3208-13-0x000001BECFC48000-0x000001BECFC49000-memory.dmp
memory/3208-5-0x000001BF0FC3E000-0x000001BF0FC3F000-memory.dmp
memory/3208-4-0x000001BECFC45000-0x000001BECFC46000-memory.dmp
memory/3208-2-0x000001BECFC44000-0x000001BECFC45000-memory.dmp
memory/3208-18-0x000001BECFC49000-0x000001BECFC4A000-memory.dmp
memory/3208-28-0x000001BECFC4D000-0x000001BECFC4E000-memory.dmp
memory/3208-27-0x000001BECFC41000-0x000001BECFC42000-memory.dmp
memory/3208-26-0x000001BECFC4C000-0x000001BECFC4D000-memory.dmp
memory/3208-25-0x000001BECFC4A000-0x000001BECFC4B000-memory.dmp
memory/3208-24-0x000001BECFC4B000-0x000001BECFC4C000-memory.dmp
memory/3208-30-0x000001BECFC4E000-0x000001BECFC4F000-memory.dmp
memory/3208-46-0x000001BECFC42000-0x000001BECFC43000-memory.dmp
memory/3208-45-0x000001BECFC50000-0x000001BECFC51000-memory.dmp
memory/3208-44-0x000001BECFC4F000-0x000001BECFC50000-memory.dmp
memory/3208-55-0x000001BECFC58000-0x000001BECFC59000-memory.dmp
memory/3208-54-0x000001BECFC57000-0x000001BECFC58000-memory.dmp
memory/3208-53-0x000001BECFC53000-0x000001BECFC54000-memory.dmp
memory/3208-52-0x000001BECFC56000-0x000001BECFC57000-memory.dmp
memory/3208-51-0x000001BECFC54000-0x000001BECFC56000-memory.dmp
memory/3208-50-0x000001BECFC47000-0x000001BECFC48000-memory.dmp
memory/3208-49-0x000001BECFC46000-0x000001BECFC47000-memory.dmp
memory/3208-48-0x000001BECFC52000-0x000001BECFC53000-memory.dmp
memory/3208-47-0x000001BECFC51000-0x000001BECFC52000-memory.dmp
memory/3208-56-0x000001BECFC59000-0x000001BECFC5A000-memory.dmp
memory/3208-58-0x000001BECFC4D000-0x000001BECFC4E000-memory.dmp
memory/3208-59-0x000001BECFC5B000-0x000001BECFC5C000-memory.dmp
memory/3208-57-0x000001BECFC5A000-0x000001BECFC5B000-memory.dmp
memory/3208-60-0x000001BECFC4E000-0x000001BECFC4F000-memory.dmp
memory/3208-61-0x000001BEC2000000-0x000001BEC2200000-memory.dmp
memory/3208-62-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-66-0x000001BECFC5E000-0x000001BECFC5F000-memory.dmp
memory/3208-65-0x000001BECFC5C000-0x000001BECFC5D000-memory.dmp
memory/3208-64-0x000001BECFC5D000-0x000001BECFC5E000-memory.dmp
memory/3208-71-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-83-0x000001BEC2000000-0x000001BEC2200000-memory.dmp
memory/3208-82-0x000001BECFC61000-0x000001BECFC62000-memory.dmp
memory/3208-85-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-84-0x000001BEC2000000-0x000001BEC2200000-memory.dmp
memory/3208-81-0x000001BECFC60000-0x000001BECFC61000-memory.dmp
memory/3208-80-0x000001BECFC5F000-0x000001BECFC60000-memory.dmp
memory/3208-79-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-78-0x000001BECFC6D000-0x000001BECFC6E000-memory.dmp
memory/3208-77-0x000001BECFC6C000-0x000001BECFC6D000-memory.dmp
memory/3208-76-0x000001BECFC6B000-0x000001BECFC6C000-memory.dmp
memory/3208-75-0x000001BECFC6A000-0x000001BECFC6B000-memory.dmp
memory/3208-74-0x000001BECFC69000-0x000001BECFC6A000-memory.dmp
memory/3208-73-0x000001BECFC68000-0x000001BECFC69000-memory.dmp
memory/3208-72-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-70-0x000001BEC2000000-0x000001BEC2200000-memory.dmp
memory/3208-69-0x000001BECFC66000-0x000001BECFC67000-memory.dmp
memory/3208-68-0x000001BECFC65000-0x000001BECFC66000-memory.dmp
memory/3208-67-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-63-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-88-0x000001BECFC67000-0x000001BECFC68000-memory.dmp
memory/3208-91-0x000001BECFC70000-0x000001BECFC74000-memory.dmp
memory/3208-92-0x000001BEC2000000-0x000001BEC2200000-memory.dmp
memory/3208-90-0x000001BECFC74000-0x000001BECFC76000-memory.dmp
memory/3208-93-0x000001BECFC76000-0x000001BECFC77000-memory.dmp
memory/3208-89-0x000001BECFC6E000-0x000001BECFC6F000-memory.dmp
memory/3208-87-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-86-0x000001BEC2000000-0x000001BEC2200000-memory.dmp
memory/3208-96-0x000001BECFC58000-0x000001BECFC59000-memory.dmp
memory/3208-95-0x000001BECFC57000-0x000001BECFC58000-memory.dmp
memory/3208-94-0x000001BECFC56000-0x000001BECFC57000-memory.dmp
memory/3208-97-0x000001BECFC77000-0x000001BECFC78000-memory.dmp
memory/3208-99-0x000001BECFC79000-0x000001BECFC7A000-memory.dmp
memory/3208-98-0x000001BECFC78000-0x000001BECFC79000-memory.dmp
memory/3208-100-0x000001BEC2000000-0x000001BEC2200000-memory.dmp
memory/3208-101-0x000001BECFC5B000-0x000001BECFC5C000-memory.dmp
memory/3208-102-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-103-0x000001BF15400000-0x000001BF15600000-memory.dmp
memory/3208-104-0x000001BEC2000000-0x000001BEC2200000-memory.dmp