be218a23bd01580e7808fb5213faec1f57a5408c545441e9cfb5ab9be1c43973

Analysis

user interaction
yes
max time kernel
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.exe
Size 304.0MB
Sample260713-zcbcssh14y
SHA256 be218a23bd01580e7808fb5213faec1f57a5408c545441e9cfb5ab9be1c43973
MD5 6b82605cfdf5dfe4095dc424c25a2bab
SHA1 2a1b806214493249113e52f8b2c88b49fcc233aa
SHA512 787e14e7a7320a15714e14ceecb3e7e25c134992ef0d586a17107315f86659bf543a8b9676396c310eccb892cf4c5b8b0f1969375b9a3b35d460b8479d926bcf
SSDEEP 6291456:RxpL/XPk1cKxb+BewAqL5pElLu205gEPjt3pf3RRiOsG0f+MG:HpTXPhKMQwAqL5pElS2059t3FniGMG
TLSH
T1B6E833726159643EDA99C7B6CB72F2404DBFBF39B886D80F91F43448DB396742923242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery installer

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\OBSBOT Center\bin\is-MNOFM.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-2S3DM.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-core-synch-l1-2-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\data\rmfunc\indshow\rm-virtualcam-module32.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-HLO3Q.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-P96PU.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\data\center\font\is-TVF56.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\libmbedcrypto.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\Qt6Gui.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\tls\qcertonlybackend.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-5S8B8.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-E6CKT.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-L1IB7.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\multimedia\is-JQJ7G.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\data\center\is-MALQ3.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-crt-conio-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-crt-heap-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\concrt140.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-3MK5Q.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-CH3TQ.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-QJ0MG.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-core-handle-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-ADHKA.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-5EF5M.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-F5T52.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-1JDBR.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\libssl-3-x64.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\rm-qsv.exe	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-I1F75.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\librist.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\rmfunc\indshow.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\rmfunc\raw-output.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-AEGM5.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-J5N8T.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-953B6.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-core-datetime-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\msvcp140_1.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-6Q022.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-TOI08.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-TJTPG.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-crt-locale-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-crt-runtime-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-TAVTE.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-G8OAH.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-5MQAD.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-core-util-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-core-memory-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\Qt6WebSockets.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\rmfunc\vdswitch.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-546R8.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-2UK05.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-5LR1N.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\libcrypto-3-x64.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\avformat-60.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\Qt6OpenGLWidgets.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-ULUCU.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\api-ms-win-crt-time-l1-1-0.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-4L637.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-93I3Q.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File opened for modification	C:\Program Files\OBSBOT Center\bin\platforms\qminimal.dll	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-2I5R4.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-DQP9C.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-M5BHT.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
File created	C:\Program Files\OBSBOT Center\bin\is-81CAP.tmp	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp

Executes dropped EXE 1 IoCs

pid	Process
4116	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4644-0-0x0000000000400000-0x00000000004E3000-memory.dmp	innosetup
behavioral2/memory/4644-8-0x0000000000400000-0x00000000004E3000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4116	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
4116	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4116	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4116	4644	Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.exe	88

C:\Users\Admin\AppData\Local\Temp\Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.exe
"C:\Users\Admin\AppData\Local\Temp\Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\is-9F8L3.tmp\Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9F8L3.tmp\Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp" /SL5="$400FA,317799849,877568,C:\Users\Admin\AppData\Local\Temp\Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9F8L3.tmp\Obsbot_Center_OA_E_Win_x64_2.0.14.53_release.tmp
Size 3.1MB
SHA256 ee9ebdeb05dee77423dd4066ad74c3d47d92ea5950e4ef6ba9255046869dd272
MD5 ebde0a5b401d2334b3e0d7d290f61b63
SHA1 42c34db4745d66da9c5ff53ce61cfccbc18f6148
SHA512 842ced3ca789dc148379d44cd450246ad535c3cfe1f83308805db105778962a46e1896699f6708fca9addf7540165593bf0d5b717dcfff1062bd138783c5201e
SSDEEP 49152:mWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbP333w/lHab:KtLutqgwh4NYxtJpkxhGc333w/lHW
TLSH
T178E51916F288613ED06BBA31C723A550983FFF7169128C1797F8794C8E365B42A3F646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4116-16-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-22-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-201-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-10-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4116-9-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-12-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-14-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-34-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-6-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/4116-18-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-20-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-24-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-26-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-28-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-30-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4116-32-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4644-0-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

memory/4644-8-0x0000000000400000-0x00000000004E3000-memory.dmp

Download