Overview

overview

10

Static

static

3

BongoCat_1...up.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

bongo-cat.exe

windows10-2004-x64

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    106s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/04/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BongoCat_1.0.0_arm64-setup.exe
  • Size 4.8MB
  • Sample260417-e2xl4sfs6p
  • SHA256 7d46179510826004301bd9e729fe3637c53b22f2e5be5926ce9b805df6104687
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discovery

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3292
      • C:\Users\Admin\AppData\Local\Temp\BongoCat_1.0.0_arm64-setup.exe
        "C:\Users\Admin\AppData\Local\Temp\BongoCat_1.0.0_arm64-setup.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4020
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1900

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            texture_01.png
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\demomodel.1024\texture_01.png
            • Size 188KB
            • SHA256 3332efb5349cdf54ea70f1ba491791d3690d48876d8abea19cb7c3f3ef383d93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            texture_02.png
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\demomodel.1024\texture_02.png
            • Size 96KB
            • SHA256 681fcc7634d723cb10cfe4efa4eccb16c2b90d51647fff2f9904aaa298f030c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            exp_1.exp3.json
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\exp_1.exp3.json
            • Size 251B
            • SHA256 541a5ede50e9e171304f695e63cac38e874063b6ee6e85983f222d552db79b5a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            exp_2.exp3.json
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\exp_2.exp3.json
            • Size 148B
            • SHA256 0063307aca198054191994f8879f0bdff802dbf0b4256a9c6eecd0a23284f764
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            live2d_expression0.exp3.json
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\live2d_expression0.exp3.json
            • Size 58B
            • SHA256 83a3ec66159eaeb2037d7a9afa6f11fe2066674102b5c33d9ca4f80b460d6896
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            live2d_expression1.exp3.json
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\live2d_expression1.exp3.json
            • Size 162B
            • SHA256 6e03aeb21de3fadad14a0bdda92aacc7b1f780d71d71dd01e4f7e09ca0a55585
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            live2d_expression2.exp3.json
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\live2d_expression2.exp3.json
            • Size 162B
            • SHA256 304ecf6855627cfd5833a971fab3e01c9a5edd2446637ef1c7b47fe07124eacd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            live2d_motion1.flac
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\live2d_motion1.flac
            • Size 463KB
            • SHA256 308a2f866ac4bcb853f34bf4e4a97dd4276217b4ef18522f5eb2a92abdf7acfd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            live2d_motion1.motion3.json
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\live2d_motion1.motion3.json
            • Size 1KB
            • SHA256 5da95705b1fdc82e99a080ddd98b4e0ae9530787dbb3c5643e6abe816a2903f8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            live2d_motion2.motion3.json
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\assets\models\standard\live2d_motion2.motion3.json
            • Size 1KB
            • SHA256 d3dd86574fbfdaa8afce162e9cacefe4e38f3311f7db2857fe29fb8772db291a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            bongo-cat.exe
            • Path C:\Users\Admin\AppData\Local\Programs\BongoCat\bongo-cat.exe
            • Size 8.1MB
            • SHA256 aee2b842db04fd474abb292f0ea46613c71d778859ca397848e088f185c31255
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LangDLL.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsfF975.tmp\LangDLL.dll
            • Size 5KB
            • SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsfF975.tmp\System.dll
            • Size 12KB
            • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UserInfo.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsfF975.tmp\UserInfo.dll
            • Size 4KB
            • SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsfF975.tmp\modern-wizard.bmp
            • Size 25KB
            • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsfF975.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsis_tauri_utils.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsfF975.tmp\nsis_tauri_utils.dll
            • Size 30KB
            • SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download