Overview

overview

6

Static

static

1

BlueStacks...==.exe

windows10-2004-x64

6

BlueStacks...==.exe

windows11-ltsc_2024-x64

6

Analysis

  • geolocation tags

    cacanadananorth-americatoronto
  • user interaction
    yes
  • max time kernel
    69s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacksInstaller_5.22.252.1007_native_88e463afc1d2a90d7ee192fc296216d4_MzsxNSwwOzUsNTsxNQ==.exe
  • Size 930KB
  • Sample260804-p8wcqs1dnb
  • SHA256 afacf945aefadf6dda09485466bb61c0f043f75c5087788019535b7621c0ef8a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.252.1007_native_88e463afc1d2a90d7ee192fc296216d4_MzsxNSwwOzUsNTsxNQ==.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.252.1007_native_88e463afc1d2a90d7ee192fc296216d4_MzsxNSwwOzUsNTsxNQ==.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5824
    • C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\BlueStacksInstaller.exe"
      2⤵
      • Downloads MZ/PE file
      • Enumerates connected drives
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4808
      • C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        PID:3928
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.252.1007_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.252.1007_nxt.exe" -s
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2884
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:3368
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • Executes a command shell one-liner
            PID:5420
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              PID:9668
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              PID:9700
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              PID:9732
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              PID:9872
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:9784

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          green.vbs
          • Path C:\Program Files (x86)\BlueStacks X\green.vbs
          • Size 66B
          • SHA256 9aadc49b300c730ff96b3aecbd5eca60dc7d7b725b41d1c689dd58ce13421fe1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_disabled.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
          • Size 569B
          • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_hover.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
          • Size 653B
          • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_normal.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
          • Size 569B
          • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_pressed.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
          • Size 653B
          • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          backicon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\backicon.png
          • Size 15KB
          • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          change_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\change_hover.png
          • Size 310B
          • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_red.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\close_red.png
          • Size 15KB
          • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          custom.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\custom.png
          • Size 17KB
          • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          discord_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\discord_icon.png
          • Size 564B
          • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          discord_icon_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\discord_icon_hover.png
          • Size 512B
          • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          folder.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\folder.png
          • Size 298B
          • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          help_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\help_icon.png
          • Size 1KB
          • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          info_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\info_icon.png
          • Size 929B
          • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_bg.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\installer_bg.jpg
          • Size 78KB
          • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\installer_logo.png
          • Size 9KB
          • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_minimize.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\installer_minimize.png
          • Size 113B
          • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          loader.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\loader.png
          • Size 279B
          • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          logo_text.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\logo_text.png
          • Size 4KB
          • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setpath.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Assets\setpath.png
          • Size 15KB
          • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacksInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\BlueStacksInstaller.exe
          • Size 648KB
          • SHA256 c142d875a047f50a2c25f39671965c253da9923635c946c5e811ce8951cc6a28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacksInstaller.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\BlueStacksInstaller.exe.config
          • Size 324B
          • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HD-CheckCpu.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\HD-CheckCpu.exe
          • Size 200KB
          • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          JSON.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\JSON.dll
          • Size 411KB
          • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.en-US.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\Locales\i18n.en-US.txt
          • Size 22KB
          • SHA256 8936455d79f33eb298869f1654286db493fb5b11b580ef7e8d859ce63541ba91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ThemeFile
          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C6E59E9\ThemeFile
          • Size 80KB
          • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_bg_1.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
          • Size 30KB
          • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BgWorker.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsvA7FA.tmp\BgWorker.dll
          • Size 12KB
          • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsvA7FA.tmp\System.dll
          • Size 11KB
          • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsvA7FA.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDui.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsvA7FA.tmp\nsDui.dll
          • Size 3.0MB
          • SHA256 c2d2b012fab62a66f1c4463b6509e8bea8b8c9a61a5fe0c432d574f16b6bfc3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis7z.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsvA7FA.tmp\nsis7z.dll
          • Size 434KB
          • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/268-194-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-144-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-150-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-149-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-159-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-180-0x000000001D110000-0x000000001D118000-memory.dmp
          Download

          memory/268-147-0x000000001BD60000-0x000000001BDC8000-memory.dmp
          Download

          memory/268-162-0x000000001E120000-0x000000001E12E000-memory.dmp
          Download

          memory/268-191-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-192-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-193-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-157-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-158-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-161-0x000000001E150000-0x000000001E18E000-memory.dmp
          Download

          memory/268-195-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-165-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-164-0x00000000227D0000-0x0000000022CF8000-memory.dmp
          Download

          memory/268-167-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-156-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-163-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-145-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-197-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-143-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
          Download

          memory/268-142-0x0000000000EF0000-0x0000000000F94000-memory.dmp
          Download

          memory/268-141-0x00007FFC242BF000-0x00007FFC242C0000-memory.dmp
          Download