Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 23:50
General
- Target RecallSetup.exe
- Size 13.5MB
- Sample261113-3vsxcats6l
- SHA256 1e6a4bdbc6a3c797787873c392c1c60128ed045e38561342da99d0b8d3d2acc0
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RecallSetup.exe"C:\Users\Admin\AppData\Local\Temp\RecallSetup.exe"1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Recall-Setup-ea149940a6994bf19101f3ee811d7f0b\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\Recall-Setup-ea149940a6994bf19101f3ee811d7f0b\vc_redist.x64.exe" /install /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{5CCD35D9-6DF1-4B9B-A171-DD276AB8EF1E}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{5CCD35D9-6DF1-4B9B-A171-DD276AB8EF1E}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Recall-Setup-ea149940a6994bf19101f3ee811d7f0b\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{BC27596F-3977-4828-9293-86EA7126EB78}\.be\VC_redist.x64.exe"C:\Windows\Temp\{BC27596F-3977-4828-9293-86EA7126EB78}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BF073206-474A-43E4-AEF6-A2BE114E5B31} {698D72C1-4706-49D3-83CF-2507C1D35DBA} 21444⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vc_redist.x64.exe
vc_redist.x64.exe
logo.png
wixstdba.dll
memory/3284-32-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-40-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-6-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-7-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-8-0x000000001CB80000-0x000000001CB8A000-memory.dmp
memory/3284-10-0x000000001CC00000-0x000000001CC12000-memory.dmp
memory/3284-0-0x00007FFE2CE8F000-0x00007FFE2CE90000-memory.dmp
memory/3284-37-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-38-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-5-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-39-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-44-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-46-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-45-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-4-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-3-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp
memory/3284-1-0x0000000000010000-0x0000000000D9A000-memory.dmp
memory/3284-2-0x00007FFE2CD00000-0x00007FFE2D6A4000-memory.dmp