Overview
overview
8Static
static
3Harbor_0.9...1].exe
windows10-2004-x64
7Harbor_0.9...1].exe
windows11-ltsc_2024-x64
8$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3ffmpeg.exe
windows10-2004-x64
1ffmpeg.exe
windows11-ltsc_2024-x64
1ffprobe.exe
windows10-2004-x64
1ffprobe.exe
windows11-ltsc_2024-x64
8fonts/LICE...JP.txt
windows10-2004-x64
1fonts/LICE...JP.txt
windows11-ltsc_2024-x64
1fonts/Noto...ld.otf
windows10-2004-x64
7fonts/Noto...ld.otf
windows11-ltsc_2024-x64
8fonts/Noto...ar.otf
windows10-2004-x64
7fonts/Noto...ar.otf
windows11-ltsc_2024-x64
3harbor.exe
windows10-2004-x64
6harbor.exe
windows11-ltsc_2024-x64
6libmpv-2.dll
windows10-2004-x64
1libmpv-2.dll
windows11-ltsc_2024-x64
8Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 03:29
Behavioral task
behavioral1
Sample
Harbor_0.9.20_x64-setup[1].exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Harbor_0.9.20_x64-setup[1].exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
ffmpeg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ffmpeg.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
ffprobe.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
ffprobe.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
fonts/LICENSE-OFL-NotoSansJP.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
fonts/LICENSE-OFL-NotoSansJP.txt
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
fonts/NotoSansJP-Bold.otf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
fonts/NotoSansJP-Bold.otf
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
fonts/NotoSansJP-Regular.otf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
fonts/NotoSansJP-Regular.otf
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
harbor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
harbor.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
libmpv-2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
libmpv-2.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
General
- Target $PLUGINSDIR/modern-header.bmp
- Size 25KB
- Sample260708-d2dnkaaz5m
- SHA256 44a0326fa861ad24afa76fe1d5505fed20b4832cbb87ead5ec60edfec58cbb0b
- MD5 515c99d019caf0c709518161025f3151
- SHA1 7da628a2ac228353ad5239eb107e2c7909229033
- SHA512 a7bc9afa67203b1373007fa4aff91b3e8ee8e8107fd54e87ac9b8d1fac558c43f30e14550c37f2fb76b100f5668514d13039f8fd6620426702fe033da07e48a8
- SSDEEP 96:OXIIIIIIIIIIIIIIIIIIIII8orvxSccnWoTKO:OXIIIIIIIIIIIIIIIIIIIIIlrJSccnvF
- TLSH T1BFC2EFF6E726C418C9666B908D79B5AEC28B5F5CAC20A9C33418F32F7B733DD1009950
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2000 mspaint.exe 2000 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2000 mspaint.exe 2000 mspaint.exe 2000 mspaint.exe 2000 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-header.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4432