General
- Target setup_x64.exe
- Size 131.7MB
- Sample261102-3nbdqady4v
- SHA256 b9cf4d76059414fa7e100a211fcc772dc05b22722a8dac83bbef6cc8f2cd5336
- MD5 2db8f99beec4fede0184bb73c37d04b3
- SHA1 a4b3cb4d16ed19b3bf4646c1ab369c9c36b1ec2c
- SHA512 383583a9d76524a443943b636b2654f9dc91f919b02f08cb225dcdab498420a7ea7852a41f53aca1afc91820a6239346de1f56238490aceea308de2b993c2b78
- SSDEEP 3145728:u50tWyM8ZJqtnFpThwoP8fsG5iVUsUsBjHjwa:aHyMKJgFTEUGAPjjv
- TLSH T1746833785F633096E25153F2A586231F4F6AAFD40AD962A34870B30FF87C542EBF5129
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
setup_x64.exe
Resource
win11-20260911-en
22 signatures
300 seconds
Malware Config
Targets
-
- Target setup_x64.exe
- Size 131.7MB
- SHA256 b9cf4d76059414fa7e100a211fcc772dc05b22722a8dac83bbef6cc8f2cd5336
- MD5 2db8f99beec4fede0184bb73c37d04b3
- SHA1 a4b3cb4d16ed19b3bf4646c1ab369c9c36b1ec2c
- SHA512 383583a9d76524a443943b636b2654f9dc91f919b02f08cb225dcdab498420a7ea7852a41f53aca1afc91820a6239346de1f56238490aceea308de2b993c2b78
- SSDEEP 3145728:u50tWyM8ZJqtnFpThwoP8fsG5iVUsUsBjHjwa:aHyMKJgFTEUGAPjjv
- TLSH T1746833785F633096E25153F2A586231F4F6AAFD40AD962A34870B30FF87C542EBF5129
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Process Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Process Injection
1