Analysis
- user interaction
yes - max time kernel
156s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 01:44
General
- Target MSI_Lite_v5.12_GG_HieuGLLite.exe
- Size 516.7MB
- Sample260712-b5zdbsd17w
- SHA256 6380a5df2310660b45aaa19a3294119c42fda06fe607381de1e4a0f9d614ed4f
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MSI_Lite_v5.12_GG_HieuGLLite.exe"C:\Users\Admin\AppData\Local\Temp\MSI_Lite_v5.12_GG_HieuGLLite.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0E52BF89\Setup.exe"C:\Users\Admin\AppData\Local\Temp\7zS0E52BF89\Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCA49C499\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\7zSCA49C499\Bootstrapper.exe" -DefaultImageName=Nougat32 -ImageToLaunch=Nougat323⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCA49C499\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zSCA49C499\BlueStacksInstaller.exe" -DefaultImageName="Nougat32" -ImageToLaunch="Nougat32" -parentpath="C:\Users\Admin\AppData\Local\Temp\7zS0E52BF89\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
backicon.png
checked_gray.png
close_red.png
custom.png
installer_bg.jpg
installer_minimize.png
setpath.png
unchecked_gray.png
BlueStacksInstaller.exe
Bootstrapper.exe
Bootstrapper.exe.config
HD-Common.dll
i18n.en-US.txt
Newtonsoft.Json.dll
ThemeFile
memory/3024-133-0x000000001C1E0000-0x000000001C708000-memory.dmp
memory/3024-146-0x000000001C1D0000-0x000000001C1D8000-memory.dmp
memory/3024-130-0x0000000002650000-0x00000000026D0000-memory.dmp
memory/3024-148-0x0000000020560000-0x000000002056E000-memory.dmp
memory/3024-127-0x0000000000480000-0x00000000004D4000-memory.dmp
memory/3024-147-0x0000000020590000-0x00000000205CE000-memory.dmp
memory/3704-121-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/3704-134-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/3704-120-0x000000001B2F0000-0x000000001B3D4000-memory.dmp
memory/3704-118-0x00007FFCAADAF000-0x00007FFCAADB0000-memory.dmp
memory/3704-117-0x0000000000610000-0x0000000000638000-memory.dmp
memory/3704-122-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/3704-123-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/3704-128-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp