Overview

overview

7

Static

static

3

MasterstrapSetup.exe

windows10-2004-x64

7

MasterstrapSetup.exe

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    60s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/06/2026, 11:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MasterstrapSetup.exe
  • Size 6.3MB
  • Sample260620-m9c7faev7j
  • SHA256 c7cc3a47b00ae700cbef7c35b835d7638c0a17e6f29980bb6f22f64bc6e0a967
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MasterstrapSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\MasterstrapSetup.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.exe
      "C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3024
  • C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.exe
    "C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Masterstrap.deps.json
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.deps.json
        • Size 3KB
        • SHA256 488816ed789eaab393b80bdf088006bf2c1c3cf009c94ad66cd4dcdee3d75c6a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Masterstrap.dll
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.dll
        • Size 8.8MB
        • SHA256 ba2ae0a9322388f0bba8f25cff622dcb75c64dd26a9648b15dac7717df6595f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Masterstrap.exe
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.exe
        • Size 213KB
        • SHA256 321f5f0cd2af750b5595dbc95194f3c01f59b34f4341ab1064a55fac82cebcd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Masterstrap.runtimeconfig.json
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.runtimeconfig.json
        • Size 458B
        • SHA256 c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        blue.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\blue.png
        • Size 659B
        • SHA256 64ecbb34f6a6dbc321564618a894043db7eb1e3c925812019ae9cd865774e741
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        green.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\green.png
        • Size 864B
        • SHA256 512cced9c932e8e400cf13ee60b236256775b6fa64e7200914117c68e31ac783
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        mini-green.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\mini-green.png
        • Size 787B
        • SHA256 e28a88473f60350349a619d3bf33e1599d6c4f576c882046321f599a0e6c4cf4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        purple.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\purple.png
        • Size 824B
        • SHA256 5cb9ba1c479346b66d3c3a596707f6fa5bd53c0acc30dd693be51d9ca4278e5c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        red.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\red.png
        • Size 670B
        • SHA256 9996857d6c58f58442f5ca9860fc76e7be20d9719f973c36d8f3526f09293ac4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        small-white.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\small-white.png
        • Size 1KB
        • SHA256 a3b1df30f06b26f8f43c150d5aee728c08c561acad9cba97b7a4470d51b1aff8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        white.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\white.png
        • Size 586B
        • SHA256 6e867e65ec9898c88dec6fc9fdb187c608637fe79ecbf9674c4f6a17297c4aea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        yellow.png
        • Path C:\Users\Admin\AppData\Local\Masterstrap\Application\crosshair\yellow.png
        • Size 756B
        • SHA256 e3d62a61389e722fb2d4dfe2f6ccc8bcd8405924c226c0f7d16090c26aa43708
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sky512_rt.tex
        • Path C:\Users\Admin\AppData\Local\Masterstrap\SkyboxPack\ChromaKey\sky512_rt.tex
        • Size 2KB
        • SHA256 eeac6dbe921a9841190645bdf545dfa58d5d63b8cb225dc5dd674ad90e9fba9b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        NativeSupport.dll
        • Path C:\Users\Admin\AppData\Local\Masterstrap\native\NativeSupport.dll
        • Size 978KB
        • SHA256 b94ca33f06fb6f1cc2b5d49311550b5470f202447356928ae356ff07326ee1f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Masterstrap_runtime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Masterstrap_runtime.log
        • Size 631B
        • SHA256 f39e5b5d30fbb9acb33322682f16ee9583ba09fb4cb5484610fe97d4d0eb1499
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Masterstrap_runtime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Masterstrap_runtime.log
        • Size 1003B
        • SHA256 cc453c7fcb2ddef4f827a1dc4b7994c16a9c4eebcf8922e4144b2517e190726c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Masterstrap_runtime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Masterstrap_runtime.log
        • Size 1KB
        • SHA256 5a4da2d0d69fb1ea84ece33d68abc46b2270382c1ffa212f5745ef69f031fda4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Masterstrap_runtime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Masterstrap_runtime.log
        • Size 4KB
        • SHA256 24878969d59d45d5fd10c89bd18ad79e14ac639537eae3af9bd9439644eec8bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FFlags.hpp
        • Path C:\Users\Admin\AppData\Roaming\Masterstrap\OffsetsCache\FFlags.hpp
        • Size 1.1MB
        • SHA256 0bf3b96bd09856d4a08737dfd961e127ab601bc136e29459fb980d3cc2435e15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Offsets.hpp
        • Path C:\Users\Admin\AppData\Roaming\Masterstrap\OffsetsCache\Offsets.hpp
        • Size 25KB
        • SHA256 dc0fe62acde06df66cd8c0665f894630d3fe87dc1bf26b5717efa9b844ae3b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        meta.json
        • Path C:\Users\Admin\AppData\Roaming\Masterstrap\OffsetsCache\meta.json
        • Size 308B
        • SHA256 a9363f00ba20246c382b6e0a9b5de25520f683483de18b27e5361e3e44216597
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        settings.json
        • Path C:\Users\Admin\AppData\Roaming\Masterstrap\settings.json
        • Size 127B
        • SHA256 6e31a8fba21f5865233e1a94c2e3dc6eaebf08a4f99733359bfa4f05ec7010a7
        • MD5 SHA1 SHA512 TLSH
        Submit Download