Overview
overview
6Static
static
1tiktok_liv...1z.exe
windows10-2004-x64
6tiktok_liv...1z.exe
windows11-21h2-x64
4$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows11-21h2-x64
3$PLUGINSDI...ro.dll
windows10-2004-x64
3$PLUGINSDI...ro.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsis_plugin.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsis_plugin.dll
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/shell_downloader_pro.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/shell_downloader_pro.dll
Resource
win11-20260130-en
General
- Target tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe
- Size 3.9MB
- Sample260421-jesf4ady5x
- SHA256 cee0b19b7471f026dcf4d04c31e36ce5f3d4c29999e980a2276e2f8838eaa167
- MD5 4e62f79bc9396089acddc07ee97d0ef3
- SHA1 ea2e5951f4e80475b58509cc3aade5986e14e578
- SHA512 aba51021829e549951f1fb098b4adbed065b3e09acedb86f4c68093eb09304328b240a95571581c1025386f8289ce8cea1247b6a091934a3f868cb4d8e226f68
- SSDEEP 98304:bHpZB+u8zDafAlYQhIlugnqVVNOj84WZuVzvEoDNDBxpyomb0E:bRD0DSQYQhIPJjsZuVzDdHyoG0E
- TLSH T1361633121E30F547C4329DF67F064AA28DFA069468A65FDD9537ECB82CB53C9322E172
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe - Loads dropped DLL 4 IoCs
pid Process 3912 tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe 3912 tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe 3912 tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe 3912 tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe"C:\Users\Admin\AppData\Local\Temp\tiktok_live_studio_downloader-v0.0.1-wid-95wcNiIGg1z.exe"1⤵
- Checks system information in the registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:3912
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsl868.tmp\StdUtils.dll
- Size 111KB
- SHA256 e946aaee3ea4d75b54e8e7b6d874c2d149189141a3523e14fb413fad3973410d
- MD5 2ac148134b65e01f0763fab3f89250e6
- SHA1 e1ac441b3d5c0e8945aa7e89b037354c96a08e20
- SHA512 b5451ffe19170aaffbcfedb5260863ca60459305fc2e0ca4f9c92b74c5cb9ffaa7b26c1e6e8aab403e591eb0e7626b8d48a53086fa1eaf29227a3904047fd3b7
- SSDEEP 3072:fNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHftrJVa:fNuZ81zaAFHhF9vWJVa
- TLSH T173B35C72A2F5ACB5E4A70B3D2469BB268CB77B383431D93F2342014BC634546DA6D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl868.tmp\System.dll
- Size 23KB
- SHA256 d0eedaa4bf4a3e54164658aebcd4eb9d7b18614603afb193541229af575641eb
- MD5 d587e4cc950feb8620d0b4e241cfa10b
- SHA1 e16baad5f75aaabb8c409e16cbc9ee1f094a40ad
- SHA512 89240f3c7527ddd20538ad974cf2caaaa67f8eaae54c77021c86e7aa7387921637624e8ed6299f97f22d4e7424f5b4f623444ae9519dc3175a210461365c4b75
- SSDEEP 384:y8PJlt70esj0Mt9vn6ay6vHQIYia8JjA9y8RbmL4nNyiXg:y+qesjRL665Yi/JM5ALUg
- TLSH T186B28E5386504CB1E9125C3474D0BE36AF75B99C2BD0C0D363DAC0956F503C73ABE296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl868.tmp\nsis_plugin.dll
- Size 2.1MB
- SHA256 521237d8ce53cbe6b25547e6f8d4bbf31e2c88390d1ddb7d6cf505158da6bded
- MD5 5ff6a32380d7093b4d3b2ce3707f969a
- SHA1 fd9c3f8e633591012928d2edff2d0ac01923c4ce
- SHA512 1e55415989c676da91f9d8f5f7335dfb20350fe4df46a8d4ee76f54dd8fd0358bec8f6d3040f1b6dc8aff9fa2947502e8f27b00f0adf38a202e80ba946152bd9
- SSDEEP 24576:YvUMT3dDIu7KHxC4QbOTQJxY5MeFUBCC2fycqEF8ZsVDJfSZYES/Y5uH3o6euP0w:wtMu7KHx/1TEeDUyES/cw3peuP0w
- TLSH T1A1A58D137552F0B9C997A3B0B23DB6782A2952504B1089D792E4BDF43AF1AC11A3377F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl868.tmp\shell_downloader_pro.dll
- Size 2.4MB
- SHA256 d4beec6ead090290faa5188655c37592034431b75877a10649fe68a12d391f50
- MD5 080f47fe48e2dd54309299231cca8e1b
- SHA1 e47a17b6483e9796f5cb06fa807a7cf1d25b8101
- SHA512 ccb9045b86686102468275b10275f98dc63fd88bc0d6b2271a3b6e47804c43959b7ea86e4fc3daf74baeea225a805410869c90056ec8fd8c2f34238baf776b27
- SSDEEP 49152:3gwrxBCQ8sOVeY1Zke3/3ImqOJDfrflXNsglE+hqV2F2:35CnsOVeY1ZkOImqOJDfrf5Nfl0F
- TLSH T14FC5AE02F511A0B0C88B2071752DAB7D5D251E640B24CDDBEBD4ADF42BF16D2263A7AF
- MD5 SHA1 SHA512 SSDEEP TLSH