Overview

overview

7

Static

static

3

Deadlock.M...up.exe

windows10-2004-x64

7

Deadlock.M...up.exe

windows11-21h2-x64

7

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

deadlock-m...er.exe

windows10-2004-x64

6

deadlock-m...er.exe

windows11-21h2-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    64s
  • max time network
    69s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/04/2026, 11:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Deadlock.Mod.Manager_0.18.0_x64-setup.exe
  • Size 22.5MB
  • Sample260424-n4a1kahs21
  • SHA256 ee1237f19f1d4bb84a7fc6e43b692ebc25d0ba7e8cb580be77739d0dca1db99b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 48 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Deadlock.Mod.Manager_0.18.0_x64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Deadlock.Mod.Manager_0.18.0_x64-setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4424
    • C:\Users\Admin\AppData\Local\Deadlock Mod Manager\deadlock-mod-manager.exe
      "C:\Users\Admin\AppData\Local\Deadlock Mod Manager\deadlock-mod-manager.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5452
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=0.18.0 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5452.3748.15422642916289841770
        3⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:5952
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x118,0x7ffeeac5b078,0x7ffeeac5b084,0x7ffeeac5b090
          4⤵
            PID:396
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=0.18.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1820,i,16435925527724544276,15551178635534700163,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
            4⤵
              PID:5464
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=0.18.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2156,i,16435925527724544276,15551178635534700163,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
              4⤵
                PID:4320
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=0.18.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2456,i,16435925527724544276,15551178635534700163,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
                4⤵
                  PID:3800
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=0.18.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3692,i,16435925527724544276,15551178635534700163,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
                  4⤵
                    PID:4048

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  deadlock-mod-manager.exe
                  • Path C:\Users\Admin\AppData\Local\Deadlock Mod Manager\deadlock-mod-manager.exe
                  • Size 42.9MB
                  • SHA256 ede8680122a8324a18f22b3b607d9d2ecbc5be21222d99476983476e6d31fb4f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg2076.tmp\System.dll
                  • Size 12KB
                  • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  modern-wizard.bmp
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg2076.tmp\modern-wizard.bmp
                  • Size 25KB
                  • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsDialogs.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg2076.tmp\nsDialogs.dll
                  • Size 9KB
                  • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsis_tauri_utils.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsg2076.tmp\nsis_tauri_utils.dll
                  • Size 33KB
                  • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 ffc64acc4d5e4eee01f01b47d4b9da17d905d56a2c313e9c7ecd1bf49871ecaa
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 cc856888d64ccfcf01bab579f3e46dc5b681054110a81ce0ac5a5ea709d31345
                  • MD5 SHA1 SHA512
                  Submit Download

                  throttle_store.dat
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad\throttle_store.dat
                  • Size 20B
                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                  • Size 72B
                  • SHA256 4eb6984a9899f6c34ca74fa299c7faecedebe9634dd34dd77f8d1d10e90dc54e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe58b61c.TMP
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58b61c.TMP
                  • Size 48B
                  • SHA256 ff2a4b72618cff32684706f6f15616c6170251c85a267c3b1142605b84b1a399
                  • MD5 SHA1 SHA512
                  Submit Download

                  index
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\DawnGraphiteCache\index
                  • Size 256KB
                  • SHA256 fa7967fb451ca83c89ccef413eb5db37009af82dcd591204a531e19f0903ce09
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\DawnWebGPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\DawnWebGPUCache\data_1
                  • Size 264KB
                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\DawnWebGPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\DawnWebGPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Extension Rules\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Preferences
                  • Size 6KB
                  • SHA256 0d216cd2ec6db547b67e78f4f4b29495bc928852791a8d44af128410c97a0479
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Preferences
                  • Size 6KB
                  • SHA256 ecfbf543ffe1d016643efeec2a8ff161ac3c3d008625c9c1d7253e243432fb6d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences~RFe58b10b.TMP
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Preferences~RFe58b10b.TMP
                  • Size 6KB
                  • SHA256 fe75a8855233a31af496089788233d255853ddd7d8ffdce5f2a6f7b346464043
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Site Characteristics Database\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Local State
                  • Size 1KB
                  • SHA256 a6720932e6cfc22ed72e9df7ccc4940ae6c620cc4762454600db1d2806ad33b3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Local State
                  • Size 2KB
                  • SHA256 b787894a1ea07de85dcd9ff00e18e63757fe8a6556902dd89f968d04c324dfac
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Local State
                  • Size 3KB
                  • SHA256 c41689fac33bf2cfb17aa6c1fe5787febc864d4512cfc7ae2b610adf34badae4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Local State
                  • Size 4KB
                  • SHA256 9b58a6780e32892d19411576c8613b5078c21c83182c67b6cb6fd5887e43ed1b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Local State
                  • Size 16KB
                  • SHA256 be591805997690355794fda5da0d2237e13a194bb845865901754ce0623b6df9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State~RFe586136.TMP
                  • Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Local State~RFe586136.TMP
                  • Size 1KB
                  • SHA256 5372c471b82028140919943682288b28d7f0716eb7decdbd520fb9c5dc337e03
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/3800-101-0x00007FFF064A0000-0x00007FFF064A1000-memory.dmp
                  Download

                  memory/3800-100-0x00007FFF07610000-0x00007FFF07611000-memory.dmp
                  Download

                  memory/4048-199-0x00007FFF05A90000-0x00007FFF05A91000-memory.dmp
                  Download

                  memory/5464-78-0x00007FFF05A90000-0x00007FFF05A91000-memory.dmp
                  Download

                  memory/5464-282-0x00000218E2800000-0x00000218E2915000-memory.dmp
                  Download

                  memory/5952-310-0x000001FF8A880000-0x000001FF8A8A7000-memory.dmp
                  Download

                  memory/5952-311-0x000001FF8D850000-0x000001FF8D88B000-memory.dmp
                  Download

                  memory/5952-273-0x000001FF82F00000-0x000001FF82F2C000-memory.dmp
                  Download

                  memory/5952-274-0x000001FF82F40000-0x000001FF82F4C000-memory.dmp
                  Download