7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Resubmissions

31/10/2026, 23:00

261031-2y24raaf58

31/10/2026, 04:31

31/10/2026, 04:25

31/10/2026, 00:28

31/10/2026, 00:03

30/10/2026, 23:40

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
135s
max time network
140s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample261031-e12vfatyfy
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1804	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1804	4600	Setup.exe	84

C:\Users\Admin\AppData\Local\Temp\Setup.exe
C:\Users\Admin\AppData\Local\Temp\Setup.exe cmd /c mkdir C:\Monaco & powershell -NoProfile -ExecutionPolicy Bypass -Command "$r=New-Object Random 20261030;$m=@{''='';Z='PK'+[char]3+[char]4;P=[char]37+'PDF-1.7 '};$d=@{U=$env:USERPROFILE;A=$env:APPDATA};'U|Desktop\passwords.txt|24576||01-PASSWORDS-TXT','U|Desktop\seed phrase.txt|61440||02-SEED-TXT','U|Documents\client_logins.xlsx|122880|Z|03-XLSX','U|Documents\network_map.pdf|245760|P|04-PDF','U|Documents\notes.docx|491520|Z|05-DOCX','U|Desktop\Database.kdbx|983040||06-KDBX','U|Downloads\invoice_2026.pdf|1976320|P|07-PDF-DOWNLOADS','U|Documents\Monero\wallets\canary_wallet.keys|1111||11-MONERO','A|Exodus\exodus.wallet\seed.seco|1333||12-EXODUS','A|Electrum\wallets\default_wallet|1555||13-ELECTRUM','A|Ethereum\wallets\canary.json|1777||14-ETHEREUM','A|atomic\Local Storage\leveldb\000003.log|1999||15-ATOMIC','U|Desktop\my_wallet.dat|2222||16-WALLET-NAME','A|Armory\canary.wallet|2444||17-ARMORY','A|Coinomi\Coinomi\wallets\canary.wallet|2666||18-COINOMI'|ForEach-Object{$f=$_.Split('|');$p=$d[$f[0]]+'\'+$f[1];New-Item -ItemType Directory -Force -Path (Split-Path $p)|Out-Null;$y=New-Object byte[] ([int]$f[2]);$r.NextBytes($y);$h=[Text.Encoding]::ASCII.GetBytes($m[$f[3]]+'CANARY-'+$f[4]+' ');[Array]::Copy($h,$y,$h.Length);[IO.File]::WriteAllBytes($p,$y)}" & Setup.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads