Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 00:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe
- Size 9.7MB
- Sample260708-akchdsht2m
- SHA256 1a087ba7075f9102bb80cfe90bf38db8c9782277ff988a691b1c63327d56f524
- MD5 6ce4bac0b23c85db7b22277b62e52f93
- SHA1 9b811ed222760215485cdcb4a525ef86acd55fff
- SHA512 fbf1003faa841e65d6e4f8f7c0598e65de0100d588f9dfa3993cfcaa0d1e242337369742c130c800f90b6ac9cd0194ebd327f307d92cb8790f8b14c078545e6e
- SSDEEP 196608:HzytB0vsaNk4Ly5sCvd6jfTD5wwjMZB+p8/X276ezvVY0kGuAfqohJ2w:Hzyf40cz5wLZ0pUSzvVYpN/of2w
- TLSH T17BA622137AC1C03FD1A245728C2F9EB843A17C235A344A5BB594FE6D2EF4582B927F19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2060 MsiExec.exe 2060 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\D: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 868 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 868 MSIEXEC.EXE Token: SeSecurityPrivilege 1756 msiexec.exe Token: SeCreateTokenPrivilege 868 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 868 MSIEXEC.EXE Token: SeLockMemoryPrivilege 868 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 868 MSIEXEC.EXE Token: SeMachineAccountPrivilege 868 MSIEXEC.EXE Token: SeTcbPrivilege 868 MSIEXEC.EXE Token: SeSecurityPrivilege 868 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 868 MSIEXEC.EXE Token: SeLoadDriverPrivilege 868 MSIEXEC.EXE Token: SeSystemProfilePrivilege 868 MSIEXEC.EXE Token: SeSystemtimePrivilege 868 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 868 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 868 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 868 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 868 MSIEXEC.EXE Token: SeBackupPrivilege 868 MSIEXEC.EXE Token: SeRestorePrivilege 868 MSIEXEC.EXE Token: SeShutdownPrivilege 868 MSIEXEC.EXE Token: SeDebugPrivilege 868 MSIEXEC.EXE Token: SeAuditPrivilege 868 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 868 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 868 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 868 MSIEXEC.EXE Token: SeUndockPrivilege 868 MSIEXEC.EXE Token: SeSyncAgentPrivilege 868 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 868 MSIEXEC.EXE Token: SeManageVolumePrivilege 868 MSIEXEC.EXE Token: SeImpersonatePrivilege 868 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 868 MSIEXEC.EXE Token: SeCreateTokenPrivilege 868 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 868 MSIEXEC.EXE Token: SeLockMemoryPrivilege 868 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 868 MSIEXEC.EXE Token: SeMachineAccountPrivilege 868 MSIEXEC.EXE Token: SeTcbPrivilege 868 MSIEXEC.EXE Token: SeSecurityPrivilege 868 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 868 MSIEXEC.EXE Token: SeLoadDriverPrivilege 868 MSIEXEC.EXE Token: SeSystemProfilePrivilege 868 MSIEXEC.EXE Token: SeSystemtimePrivilege 868 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 868 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 868 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 868 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 868 MSIEXEC.EXE Token: SeBackupPrivilege 868 MSIEXEC.EXE Token: SeRestorePrivilege 868 MSIEXEC.EXE Token: SeShutdownPrivilege 868 MSIEXEC.EXE Token: SeDebugPrivilege 868 MSIEXEC.EXE Token: SeAuditPrivilege 868 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 868 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 868 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 868 MSIEXEC.EXE Token: SeUndockPrivilege 868 MSIEXEC.EXE Token: SeSyncAgentPrivilege 868 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 868 MSIEXEC.EXE Token: SeManageVolumePrivilege 868 MSIEXEC.EXE Token: SeImpersonatePrivilege 868 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 868 MSIEXEC.EXE Token: SeCreateTokenPrivilege 868 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 868 MSIEXEC.EXE Token: SeLockMemoryPrivilege 868 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 424 GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe 868 MSIEXEC.EXE - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 868 MSIEXEC.EXE 1756 msiexec.exe 2060 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 424 wrote to memory of 868 424 GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe 88 PID 1756 wrote to memory of 2060 1756 msiexec.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe"C:\Users\Admin\AppData\Local\Temp\GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{BC4AC867-A095-441A-8297-8F3A5DDB1DED}\GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:868
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 08ACDD54E043BFD36D0FA515EE520822 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2060
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI386B.tmp
- Size 57KB
- SHA256 e886026008391aec859db251fff4c9a55a45c50c227e4063d336835073f25745
- MD5 e514c184fd59569180f9e29648481f64
- SHA1 5d2d29c996974d88ab7ac1db76581c79c77cd3be
- SHA512 9f2c1fba7c25c743cc4c7129956db96237d78346d9eff2923b542cb5d692a029046ad1528c70e20a6f86747f74f6a81d6308413fbc4e82a3fed1e941603c9c5c
- SSDEEP 768:50J8+QCTqaHxKkUmrVSarTJym3OZESrctFKjSL5bCC1/:VCTq2ttpDJT+lcGSVCU/
- TLSH T170437C127AD100B7D78A4B3165E79F279E3F7A441FE104839F714C9A2E367E0523A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3928.tmp
- Size 122KB
- SHA256 1af4d7548834c516d02c04e13f446dfb528e01f3352eabe8a6c7528e4caffeca
- MD5 2c65cc2f1516e8eed2f01ee5efa60c93
- SHA1 fa8ace92bdf6cb522357384b352389d08b0464de
- SHA512 f5a55023883795a0c27020ffcf6b4a33c37faefa808e45afbeea1f1b8eb07c4b6a82ef4dfc729d66d8cf93f8f7ffaf3f36e0c7c1cd7cddd76934b23380567f03
- SSDEEP 1536:TEBjdyQHtCMdlmWkw5fdRjsJFD2DlIBjAQRFYYBcUPook7hE0deQf4q5pqER9VVa:4ptCMbDkwnfWBkNYBc/3Fnvf4q5pqwZC
- TLSH T152C3492177E0C072E4DA2A391935D7625A3FB870AFB8D5CB73540B6E1E307D1AA36316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_is1DE4.tmp
- Size 1KB
- SHA256 89bc87802743356da0bc174f1367e682b69826bd2d5d5a71e86966c81f10ce35
- MD5 e8e34aed03a4f427ac4673d614dc1524
- SHA1 11ab788c40759c69a35ac5f712bcdaf4eecb62c4
- SHA512 3ea7a95a272323117174b2846f25bc0fa9027dd4bb3008afbdc842f9669274ffaeb6d45914061fdfa454d877b1ff119eca27fe1551b3fd1ee471b3b568b5abc1
- TLSH T1A521D88E16DED8061779104CA430CEC9C26FF5D78D6E4A1882D62B0FA0F442701499E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{BC4AC867-A095-441A-8297-8F3A5DDB1DED}\0x0407.ini
- Size 25KB
- SHA256 cba80a94ffb73171d8d54580346459cc927e1de8264b8b423a4e6eebeaaad6e7
- MD5 b6ac0c1ced36bf87bc0c6da529af99af
- SHA1 21df51e7cbfd69f7da5384cb1e842f7f68b67dc4
- SHA512 b12a98352b30af9322b72253341f975951e03c486c7b0e747f8e441490e258176add62c2484ca73d6115ae7b9426533b9da5ddddbb67e065c226e285450e1207
- SSDEEP 768:2LNV1dYKJpgAbtaPZuQ2g2HhmDqtnLOW8oXxN1HYLifZThxfrkTI0n497:2z1djJpgAb0RuQ2g2HhmDU
- TLSH T185C2CD2657E94618F2F36F00FDB853626E62BCD2BC79E50C1380559C18B1B44D9B2BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{BC4AC867-A095-441A-8297-8F3A5DDB1DED}\GuD_StarSign_Crypto_USB_Token_fuer_ELSTER_32-1.1.5.msi
- Size 8.5MB
- SHA256 4ce7707bff1de344bfcceef036005d8e28c909eb017e4a8032d09e0c5a3b4cfc
- MD5 3225bdc15ed34988db9d64f25464b001
- SHA1 3640530e23617dda9eeec308441961876e7721a4
- SHA512 23a2dd03dc4c9a15e30e06f96ed56680378aaf13936e9f2190f179bea76c960aaa0abcbfdadda90259e5c95597e54910fb3ed7693b8e08e4f6a11b7b86a4b2d4
- SSDEEP 196608:a1hfN+TM5v+qMM8Niy3klNQFxQaTbxna9:asTUvqM8NXOuC
- TLSH T10E962302754284B9E18623B58973E77C533AFC620AE2415F33EAF37E1E765E3572A085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~1D64.tmp
- Size 5KB
- SHA256 ba30a9984c1178d7f5d1d4effea6642ffc693cd70d9d45cb58ac5f55a4f723ad
- MD5 321b19502de1aee5868a0d6d17c24732
- SHA1 edfa97b6271d22625f6aba46b89c9182b274afa5
- SHA512 5d0667bcbf9c78a75225555aa4755d506ca295354b94be353323bd41d8e1e42e95d8acca7b5b4fb6207b564fc39abb85ae13f8689f7b35d1a88a50234c7ab7c6
- SSDEEP 96:rEhkMTEonjqH2qxaONuQWXsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOL:YhBgN4QWcuQaEZhdxoIWRGcQbPr/p005
- TLSH T1C2C1DD172BE6001EF6F35B45DAF0413787263C52282CDA1C55D0935A28F6D828A27BFB
- MD5 SHA1 SHA512 SSDEEP TLSH