Overview
overview
8Static
static
3AutoSubs-w...64.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3autosubs.exe
windows11-ltsc_2024-x64
6ffmpeg.exe
windows11-ltsc_2024-x64
1resources/...pF2.js
windows11-ltsc_2024-x64
3resources/...dex.js
windows11-ltsc_2024-x64
3resources/...x.html
windows11-ltsc_2024-x64
4resources/...re.bat
windows11-ltsc_2024-x64
8resources/...on.bat
windows11-ltsc_2024-x64
1resources/...ck.bat
windows11-ltsc_2024-x64
8resources/...til.js
windows11-ltsc_2024-x64
8resources/...ket.js
windows11-ltsc_2024-x64
8Analysis
- max time kernel
86s - max time network
65s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
AutoSubs-windows-x86_64.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260630-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral7
Sample
autosubs.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral8
Sample
ffmpeg.exe
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral9
Sample
resources/com.autosubs.adobe/assets/main-D2RE_pF2.js
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral10
Sample
resources/com.autosubs.adobe/jsx/index.js
Resource
win11ltsc2024-20260630-en
Behavioral task
behavioral11
Sample
resources/com.autosubs.adobe/main/index.html
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral12
Sample
resources/modules/autosubs_core.bat
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral13
Sample
resources/modules/dkjson.bat
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral14
Sample
resources/modules/font_fallback.bat
Resource
win11ltsc2024-20260630-en
Behavioral task
behavioral15
Sample
resources/modules/libavutil.js
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral16
Sample
resources/modules/ljsocket.js
Resource
win11ltsc2024-20260629-en
General
- Target AutoSubs-windows-x86_64.exe
- Size 65.3MB
- Sample260701-e4lmmagt2x
- SHA256 fdce7226b0514c85697f51374afb355a00591cc91a11b96146585d2f05ecd771
- MD5 cec7164e3df70bdff0a2bdaf39e284c6
- SHA1 5218918aa0604cb024bd521ca109babdd9250573
- SHA512 0b70bd851e7209f076783ef8c97cf6755867e85170ef698b15f82cdf290a7a0843d7d633c7ceacce27360d1fe72a6d29fba215ea0fb8233d23e4a8a6181358fb
- SSDEEP 1572864:7c+B92V5Wrk34Va4l8gixjZ4c6Ili9yoiwVj:7EXCFVa28giII+yoiwN
- TLSH T1EBE733905678F9AFFB34923046F0940B8F559F03DA9BDD2EE11A092E770E1C660578AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Loads dropped DLL 6 IoCs
pid Process 3252 AutoSubs-windows-x86_64.exe 3252 AutoSubs-windows-x86_64.exe 3252 AutoSubs-windows-x86_64.exe 3252 AutoSubs-windows-x86_64.exe 3252 AutoSubs-windows-x86_64.exe 3252 AutoSubs-windows-x86_64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoSubs-windows-x86_64.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3252 AutoSubs-windows-x86_64.exe 3252 AutoSubs-windows-x86_64.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3252 AutoSubs-windows-x86_64.exe 3252 AutoSubs-windows-x86_64.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\AutoSubs\caption-bin.drb
- Size 23KB
- SHA256 985c08548c1ad6d0a38fcbb0ddd6edb86ca9bbfc2053105258b4678cba983622
- MD5 bd32282d11b7783879856f5ce2488e54
- SHA1 693345e3681819d2d82fb1cf35e8e71390497fd8
- SHA512 61a3ddc2d7452cd2f4ab8b7d349b6bbc3386625833fd7d5643fa58fa48687599813f3bfe76326b1c8010192791e3cd712f860dd842633005f8472ed9fb83007f
- SSDEEP 384:wEL6Fc2uokU7TgbPOSphxrFlBhCNPYsXDfbvch6GNmnYdUgMMD19cnLkDDCdkxBp:wEG2WJ7TgbvphpFzOPBXD7csGNmYdUyT
- TLSH T14EB2E162F2DC05E9AD77D1325F4A044934BE84A02375A37E24C4EFC83F92D967E86D64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\com.autosubs.adobe\.debug
- Size 244B
- SHA256 096b12a37b7d5f300e8bbb5e198dc6dcad70a7a23e0c045a997cde22c04d213f
- MD5 8985c9c4827032144c3adbec9a45cab3
- SHA1 134c0d5b74312528749e74b396a47e4bd2b58e47
- SHA512 4553531ab9a0f7e1b113ffa80005960c4dd25684cc147fcd05cf35cb01368ae0cd9f42678474a579bb47f209661f10ac1b19cba48c2ca928a6212d61643685ba
- TLSH T152D0520881C9CE2103F8C920EFC8C842BBB886C610987904B8F933230B3AAB8093B034
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\com.autosubs.adobe\CSXS\manifest.xml
- Size 1KB
- SHA256 2094aa7f35983dea739141ab6a8270a82d398b4325c4f7104a540170678c0121
- MD5 9b26e719881d1fcb7325b5e59ed17bc3
- SHA1 16c40493152628c8697d9e320abf78d8b7139802
- SHA512 4d3582eff11df8544cdc79c8d91430424f721abcf049ab56c8ad7d33a11ff5a0f24bae789095db9c2889c26a6fe565916f23e06ca285a4f9f25da067a2c27827
- TLSH T11541CF85C4F96660E1E949699B9861413FF1C7E77058A61CF1FE4C310F6AA6943A3334
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\com.autosubs.adobe\assets\main-CFPuOZx_.css
- Size 3KB
- SHA256 ce8016b1f50b37c4d4a3b7bf80e905edac3270bbfcecb05bfeb677c9e2a2fddd
- MD5 2c5a8c28c7e12e749025e3fbcb647ff2
- SHA1 9c40beb2b257502c378c32b6d85c22d1b0d1ef16
- SHA512 35c2c2ac3b053aad07c3a3fd3e4c17ad5a6211a3292fbddca7283271f5c2143ab12ce899dfdb7504d03a2135a9163146669c79b02efa9c489a2df6e1548995f7
- TLSH T126817797A259623BF83FC5BD5182E6AE7000AC81C02697F8F432B565CAC76F73B91305
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\com.autosubs.adobe\assets\main-D2RE_pF2.cjs
- Size 213KB
- SHA256 85c6bd2526f2abdf3a48de243bbece9f5b6646a6320183ce1bd5f2e4355acd71
- MD5 983fba9d9994fe2c619846cd9a0f6d6c
- SHA1 740f53300377e1fb6202eb12e5e54a356f01dbbd
- SHA512 4533d000d91f423a5d4531c61091447960a9d3b3ab64c8d8ebaf83c526a073c2dae231312ef0cbf3d18e33c70a69858ffd28770017dcf6f485f1d610483d5ce0
- SSDEEP 3072:T2U48/v1Ooq3gx+11cP62rGn5L0Uv+AT5qPlUTCbYLcj1jidXP:ryEGPvxNFY+
- TLSH T106241BD831BDB6666EB346A1009F1117B23D3833244C4870E561EEAB677444752BBFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\com.autosubs.adobe\jsx\index.js
- Size 42KB
- SHA256 857585ea91e23bfcdf96ed45a7ce7a68b552d8adfbdd0ecba74d3bf0d09a2fe2
- MD5 374626c2b68edf321e50b625ac5a60df
- SHA1 188f4e67299986bc20df560a44ac60381410150f
- SHA512 2f7467dc31964ed55687824c1fa4c29bbbf9b4d84697b34dd48dc5aa877329dc3e85fd66684b70203341982502a55ce2473029118bc5fdf63d754e565fd48f9a
- SSDEEP 768:v9gWE+5KRXGjEb5bd17w2tV5/IWfWvmoECk5N53k53yz:v9xE+1E5bvw2qBW
- TLSH T1E613E78E5CE221225A3772395FEF60C5F238411B250CED90F9EDA3542F1176582FABE2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\com.autosubs.adobe\main\index.html
- Size 3KB
- SHA256 3c1f29db861ca4aade8047f12d93efe76d48ea8813cfec190bea6e159f24f5c6
- MD5 982e112ca31d17b44f739f096c4bdec7
- SHA1 4654ab14dd6ecf54f3b4a57a9359fcd8fd8ef7f6
- SHA512 cb761f99b37085605f4b291a9d7573d31731c1ea97bc74ceb1e35743ceada39ae688851bfd22bd6194bb17b913a8c36afcdcbfe891df40cb14fcc79a230095cc
- TLSH T1A981831D69E17232967232D4BC6AC146EEF6B03A2103D405748CE8A13F78D5896E7DD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\AutoSubs\resources\com.autosubs.adobe\presets\WAV_48_kHz_16_bits.epr
- Size 131KB
- SHA256 12bdf636f742dd39e3a8ad00ff77ee3f8549b9547ac1ac6fc8cf42ba3e391294
- MD5 83345b0790a1f5f4d6ef5f01b315c2c1
- SHA1 fd66d57672dae34ca7d90c625945aa676a00e255
- SHA512 a215026b214506043b65a5f638ce1c07d9f23c589ac59ccf66f81395f9500fcb3434700cbcac060e5d0151a50195fbdb8684df43d16913ae263f918a66ac9a38
- SSDEEP 192:Kk6f3F6MLi+JGfMP559Z3lGpNVXDUbyCv1ucayos0gNe9tqMgikNe5iIZ3sM+qYE:4Y2UeAO44YfjlnGTvC
- TLSH T1DAD3462D3E8E77D4C1D6C17F0AB349B0593B4EF172909029DC62A13B532EF5A2A16D72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu43DC.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu43DC.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu43DC.tmp\nsis_tauri_utils.dll
- Size 33KB
- SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
- MD5 acde70f73d3b71b1c4222b763537780d
- SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
- SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
- SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
- TLSH T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
- MD5 SHA1 SHA512 SSDEEP TLSH