Overview

overview

7

Static

static

3

Trezor-Sui...64.exe

windows10-2004-x64

7

Trezor-Sui...64.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

Trezor Suite.exe

windows10-2004-x64

7

dxil.dll

windows10-2004-x64

1

dxil.dll

windows11-ltsc_2024-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.asar

windows10-2004-x64

3

resources/app.asar

windows11-ltsc_2024-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...ngs.js

windows10-2004-x64

3

resources/...ngs.js

windows11-ltsc_2024-x64

3

resources/...ity.js

windows10-2004-x64

3

resources/...ity.js

windows11-ltsc_2024-x64

3

resources/...ors.js

windows10-2004-x64

3

resources/...ors.js

windows11-ltsc_2024-x64

3

resources/...ice.js

windows10-2004-x64

3

resources/...ice.js

windows11-ltsc_2024-x64

3

resources/...th.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Trezor Suite.exe
  • Size 221.6MB
  • Sample260720-e1cwbaey2m
  • SHA256 f5749aedea03586ddbb7fbcc716415daf4c481b5bb86f62dc9bcfdb91bf9e634
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
    "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
      "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\@trezor/suite-desktop-dev /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\@trezor/suite-desktop-dev\Crashpad --url=https://f.a.k/e --annotation=_productName=@trezor/suite-desktop-dev --annotation=_version=26.8.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.5.0 --initial-client-data=0x544,0x54c,0x550,0x478,0x554,0x7ff6619b8148,0x7ff6619b8158,0x7ff6619b8168
      2⤵
        PID:4696
      • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
        "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\@trezor/suite-desktop-dev" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,14928061754211656451,15679618379021710022,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1936,i,8198337222475409600,18354740278702296771,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
          PID:3180
        • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
          "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@trezor/suite-desktop-dev" --field-trial-handle=1932,i,14928061754211656451,15679618379021710022,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1936,i,8198337222475409600,18354740278702296771,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2096 /prefetch:3
          2⤵
            PID:2080
          • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
            "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@trezor/suite-desktop-dev" --field-trial-handle=1932,i,14928061754211656451,15679618379021710022,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1936,i,8198337222475409600,18354740278702296771,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2700 /prefetch:8
            2⤵
            • Checks computer location settings
            PID:2328
          • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
            "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@trezor/suite-desktop-dev" --app-user-model-id="electron.app.Trezor Suite" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1932,i,14928061754211656451,15679618379021710022,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1936,i,8198337222475409600,18354740278702296771,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3624 --csp-nonce=75SB7WOkT3UeldxiJ5LnjQ== /prefetch:1
            2⤵
            • Checks computer location settings
            PID:4716
          • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
            "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\dist\winHelloChildProcess.js
            2⤵
            • Checks computer location settings
            PID:4424
          • C:\Users\Admin\AppData\Local\Temp\resources\bin\bluetooth\trezor-bluetooth.exe
            C:\Users\Admin\AppData\Local\Temp\resources\bin\bluetooth\trezor-bluetooth.exe
            2⤵
              PID:5784
            • C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe
              "C:\Users\Admin\AppData\Local\Temp\Trezor Suite.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\@trezor/suite-desktop-dev" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,14928061754211656451,15679618379021710022,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1936,i,8198337222475409600,18354740278702296771,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2688 /prefetch:8
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1488

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                3ecf7404-9c5e-43d4-898d-dd47e7f65411.tmp
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\3ecf7404-9c5e-43d4-898d-dd47e7f65411.tmp
                • Size 57B
                • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\GPUCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\GPUCache\data_1
                • Size 264KB
                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\GPUCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\GPUCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\IndexedDB\file__0.indexeddb.leveldb\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\config.json
                • Size 245B
                • SHA256 3ff44412f6277327cab86b93e64b81dcf8c8bb709e6d57f777b0bcbafc234962
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-452187119974a716
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\config.json.tmp-452187119974a716
                • Size 290B
                • SHA256 8b792de6c88b283179b170bc5193b8bf5681231926ac0856a8d3cd19bed41289
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-4521871350932675
                • Path C:\Users\Admin\AppData\Roaming\@trezor\suite-desktop-dev\config.json.tmp-4521871350932675
                • Size 414B
                • SHA256 11b269c75e3e01d4e3e2546b47c4f9526aa0ba2369dd0a32d0bec0a273159fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                default.exc
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                memory/1488-639-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-640-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-635-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-637-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-638-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-628-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-629-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-630-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-634-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/1488-636-0x0000018CDBB00000-0x0000018CDBB01000-memory.dmp
                Download

                memory/4716-61-0x00007FF956AE0000-0x00007FF956AE1000-memory.dmp
                Download

                memory/4716-62-0x00007FF955650000-0x00007FF955651000-memory.dmp
                Download

                memory/5784-620-0x00007FF7610B0000-0x00007FF76128A000-memory.dmp
                Download

                memory/5784-614-0x00007FF7610B0000-0x00007FF76128A000-memory.dmp
                Download

                memory/5784-626-0x00007FF7610B0000-0x00007FF76128A000-memory.dmp
                Download