Overview

overview

6

Static

static

1

BlueStacks...U=.exe

windows10-ltsc_2021-x64

6

BlueStacks...U=.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    34s
  • max time network
    57s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    07/07/2026, 00:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacksInstaller_5.22.150.1014_native_0fec970d6759c607498c32164465c244_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
  • Size 927KB
  • Sample260707-a44e8aex4s
  • SHA256 b06249725f21fe1f31ea308113cce607f0bf0fcb07045326a9b054bf8540657f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscovery

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.150.1014_native_0fec970d6759c607498c32164465c244_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.150.1014_native_0fec970d6759c607498c32164465c244_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\BlueStacksInstaller.exe"
      2⤵
      • Downloads MZ/PE file
      • Enumerates connected drives
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1076
      • C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3344
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.150.1014_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.150.1014_nxt.exe" -s
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3008
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
            PID:5160
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c green.bat
              5⤵
                PID:5244
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall delete rule name="BlueStacksWeb"
                  6⤵
                  • Modifies Windows Firewall
                  PID:2148
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall delete rule name="Cloud Game"
                  6⤵
                  • Modifies Windows Firewall
                  PID:5392
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
                  6⤵
                  • Modifies Windows Firewall
                  PID:5536
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
                  6⤵
                  • Modifies Windows Firewall
                  PID:2692

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            green.vbs
            • Path C:\Program Files (x86)\BlueStacks X\green.vbs
            • Size 66B
            • SHA256 9aadc49b300c730ff96b3aecbd5eca60dc7d7b725b41d1c689dd58ce13421fe1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_disabled.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
            • Size 569B
            • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_hover.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
            • Size 653B
            • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_normal.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
            • Size 569B
            • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_pressed.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
            • Size 653B
            • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            backicon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\backicon.png
            • Size 15KB
            • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            change_hover.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\change_hover.png
            • Size 310B
            • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_red.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\close_red.png
            • Size 15KB
            • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            custom.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\custom.png
            • Size 17KB
            • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            discord_icon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\discord_icon.png
            • Size 564B
            • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            folder.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\folder.png
            • Size 298B
            • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            help_icon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\help_icon.png
            • Size 1KB
            • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            info_icon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\info_icon.png
            • Size 929B
            • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            installer_bg.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\installer_bg.jpg
            • Size 78KB
            • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            installer_logo.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\installer_logo.png
            • Size 9KB
            • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            installer_minimize.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\installer_minimize.png
            • Size 113B
            • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            loader.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\loader.png
            • Size 279B
            • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            logo_text.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\logo_text.png
            • Size 4KB
            • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setpath.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Assets\setpath.png
            • Size 15KB
            • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BlueStacksInstaller.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\BlueStacksInstaller.exe
            • Size 642KB
            • SHA256 640f66e9939bd13972d8dc766dc5d2d0982cf94c3f16058363a18dca363c5634
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BlueStacksInstaller.exe.config
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\BlueStacksInstaller.exe.config
            • Size 324B
            • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            HD-CheckCpu.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\HD-CheckCpu.exe
            • Size 200KB
            • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            JSON.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\JSON.dll
            • Size 411KB
            • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            i18n.en-US.txt
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\Locales\i18n.en-US.txt
            • Size 21KB
            • SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ThemeFile
            • Path C:\Users\Admin\AppData\Local\Temp\7zS8D2359B7\ThemeFile
            • Size 80KB
            • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            installer_bg_1.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
            • Size 30KB
            • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BgWorker.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nse75F7.tmp\BgWorker.dll
            • Size 12KB
            • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nse75F7.tmp\System.dll
            • Size 11KB
            • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nse75F7.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nse75F7.tmp\nsDui.dll
            • Size 3.0MB
            • SHA256 97121d42853c948fff2f1926e6f939936c2779276eaf68df7b67de2dfc535c18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsis7z.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nse75F7.tmp\nsis7z.dll
            • Size 434KB
            • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2796-150-0x00000000026E0000-0x00000000026F0000-memory.dmp
            Download

            memory/2796-184-0x00000000026E0000-0x00000000026F0000-memory.dmp
            Download

            memory/2796-183-0x00000000026E0000-0x00000000026F0000-memory.dmp
            Download

            memory/2796-182-0x00000000026E0000-0x00000000026F0000-memory.dmp
            Download

            memory/2796-171-0x0000000021900000-0x0000000021908000-memory.dmp
            Download

            memory/2796-157-0x000000001DE50000-0x000000001DE5E000-memory.dmp
            Download

            memory/2796-156-0x0000000020500000-0x0000000020538000-memory.dmp
            Download

            memory/2796-152-0x000000001DE60000-0x000000001E388000-memory.dmp
            Download

            memory/2796-149-0x00000000026E0000-0x00000000026F0000-memory.dmp
            Download

            memory/2796-145-0x000000001B240000-0x000000001B2A8000-memory.dmp
            Download

            memory/2796-143-0x00000000026E0000-0x00000000026F0000-memory.dmp
            Download

            memory/2796-142-0x0000000000500000-0x00000000005A4000-memory.dmp
            Download