0dafb664a0a0b9f1d69409d266a687a199808f3c58b7f7257d8b1761d73aed2b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
osu!AerisSetup.exe
Size 8.0MB
Sample260723-l2jhtabe44
SHA256 0dafb664a0a0b9f1d69409d266a687a199808f3c58b7f7257d8b1761d73aed2b
MD5 8f6e8db9656e85797dc5310c5d5c68bb
SHA1 dc7e037a1710d695fadced9ecd36ce8cc9c95f49
SHA512 0a1a6794bed811cf4391a98d5766a71121a1e23b53c8a88135385f16091ab665e37a7ed74111bcbbe44d33ebce320634f60e9c77a0e471de899f8db735f1f642
SSDEEP 196608:JjPEtZuJY+IbS7vCUW7xIILlTmOybNs3ncB1kD3bWzyXYr7iUy:JjPEtZaF7KxJpmr23SQIyqU
TLSH
T1FB86223FB28B253DE06A1A363A73D510443BAE61A5234C5697E4F85CCF754B01E3EA93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

costura discovery installer packer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4628	osu!AerisSetup.tmp
3888	osu!.exe
3760	osu!.exe
6120	osu!.exe

Loads dropped DLL 12 IoCs

pid	Process
3888	osu!.exe
3888	osu!.exe
3888	osu!.exe
3888	osu!.exe
3760	osu!.exe
3760	osu!.exe
3760	osu!.exe
3760	osu!.exe
6120	osu!.exe
6120	osu!.exe
6120	osu!.exe
6120	osu!.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x0007000000024645-38.dat	costura

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!AerisSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!AerisSetup.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4580-0-0x0000000000600000-0x0000000000706000-memory.dmp	innosetup
behavioral1/memory/4580-45-0x0000000000600000-0x0000000000706000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	osu!AerisSetup.tmp
4628	osu!AerisSetup.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4628	osu!AerisSetup.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4628	4580	osu!AerisSetup.exe	85
PID 4628 wrote to memory of 3888	4628	osu!AerisSetup.tmp	88

C:\Users\Admin\AppData\Local\Temp\osu!AerisSetup.exe
"C:\Users\Admin\AppData\Local\Temp\osu!AerisSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\is-MLGCXZOHA8.tmp\osu!AerisSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MLGCXZOHA8.tmp\osu!AerisSetup.tmp" /SL5="$402D8,7133786,1012224,C:\Users\Admin\AppData\Local\Temp\osu!AerisSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
    "C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe" -go
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3888

C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
"C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe" -go
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3760

C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
"C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe" -go
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

osu!AerisSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MLGCXZOHA8.tmp\osu!AerisSetup.tmp
Size 4.3MB
SHA256 ac9a026b20fd41cfa1ebb0e01d9affb882f37e865f2d8b08335cd0f30dd6445c
MD5 76ee8b891fc769a58b3a66b112da7e69
SHA1 8d8a458aee65c2a23400a0e655f5c5a17a4e7806
SHA512 0ffdac4df8a8d62f37deab42b45373b440ec0d7c316d8217637d08a90de98a3203e76738aed13f809303bd42ab22eb974baafef9a91082188a85ac8fc611948c
SSDEEP 98304:e9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JT333+T7:dItJj90Z6RgKwxn
TLSH
T158268E03B388753EE4B71A3A883FA254583F7E213A26CD4B6BF4195C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.Game.dll

Path C:\Users\Admin\AppData\Local\osu!Aeris\osu!.Game.dll
Size 2.9MB
SHA256 bdb9e26f3995614cad4a8035ffc8a56fe964fcf291c341ac2588cf9e2099978c
MD5 5136da31b300b2b8f63614d9e0cab775
SHA1 f9810175076e988c18470b2a6e682121913d482b
SHA512 ef5e7f2b67326f5a8849a179e97666f45f11bb17766cfb91df44fa98f9c7601b4e141c85a9807c7eb0b755d616724a26350ac0f8e06c9323c84563c810d0c9dc
SSDEEP 24576:xLOpU3CPlyfmV6SOvg1S64Nsnm5tWFmdvs9T+5tWFmdvs9Tl0FkHxFb2RYh3dixh:Rulp0s4NT5tWUdaC5tWUda3SYd
TLSH
T18CE56B48F2E64FF3C59E1FF2A6211428A3F4C51FA382E7574599F9A824CFB608D46463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.deps.json

Path C:\Users\Admin\AppData\Local\osu!Aeris\osu!.deps.json
Size 16KB
SHA256 25ab04f915b10ae7cfe601caa39f5d39f9608d339f8327aee266cf1e7de2a341
MD5 1ef2c4c71cec8fd991bb55e3c13143cf
SHA1 47b96319d75157aaeddf1bbd5077f52a5abb3bd7
SHA512 5dc81706203fe60468574621160b9d5b7d1b24e664591539b395cda20e43c986bfbe9945b47db8a4492670a1a911e85ed0e3e660fafa83a45baebd35e599ce4d
SSDEEP 96:QpWk9J/cveElk646rsjd86/Om/qCjsoaDQ0nS7KO9MqUDnCHjJWZXQ38BQDz48Ci:Qc2GkHLJ8w/Z9Scl+EqJUkZTZ06lA
TLSH
T189729A15D9988EB704766BB664369382F222533FA0040A4FB8FC645DDFB7E9B6081F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.dll

Path C:\Users\Admin\AppData\Local\osu!Aeris\osu!.dll
Size 5.2MB
SHA256 c9fd64948cdc01edd620be22864c7817fdceb606f8dfbba264cc774cc2b21a75
MD5 988741e9706abd9c9027ad6558a26cb6
SHA1 564b66cbd0c3aa5eaed154edf77f2766c70872c5
SHA512 bf0433c252437a3ff9cb34ab449ebe2225db8cacad0c4ba553c71b9eeb2019719f6eda585caa29111cfcdf0896dea916a521e5c3babcf693caf1d6913712a99b
SSDEEP 98304:3JmIa6fAEVoWCjsxeqqQ4b6ZW0kff47bFStl8wNOX+CYXhRHWMET:5mcAEuUxBe6Xk347bFZwUXpshZWME
TLSH
T1974633A77B5C0360D5E71332B453E86231B4DF5D47A2A87B219CF16C26363E5C3AB0A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
Size 318KB
SHA256 269e3d3437af32e486b3c22523b95222babe7b5b6f3c7380b61643a7ae587b71
MD5 6765b4f2c1e326f66b2f6ea1a9550dfe
SHA1 3a8d411ffaeacd11575745154e7e9051d19495c4
SHA512 49e95ad1277930b891747ad66692451fe9ef55aee2822b42f7d6ce947f5f8d95699daa02c139c7beb13e38628161f80a949aea2950e6022003f70feddab72bd2
SSDEEP 6144:OvgvkNFNaxmNEWJUwk+2HFhbXwtnQVsrlrkWT:OvggNaxm/kPxXrKrkWT
TLSH
T1EB648E13E3A851B9E1728A79CAB38941EB737C194B71A6CF03507A765F73AD06E38311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\osu!Aeris\osu!.runtimeconfig.json
Size 515B
SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
MD5 e0f6f18f9b152bc2d8c710b0214805d6
SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
TLSH
T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4580-0-0x0000000000600000-0x0000000000706000-memory.dmp

Download

memory/4580-45-0x0000000000600000-0x0000000000706000-memory.dmp

Download

memory/4628-5-0x00000000017C0000-0x00000000017C1000-memory.dmp

Download

memory/4628-44-0x0000000000E00000-0x0000000001261000-memory.dmp

Download