Analysis
- user interaction
yes - max time kernel
150s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Davetrap-4.0.1-win-x64/Davetrap.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Davetrap-4.0.1-win-x64/Davetrap.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target Davetrap-4.0.1-win-x64/Davetrap.exe
- Size 96.5MB
- Sample260804-wqa3eawhjd
- SHA256 80e0db32bbcaefebcc9a7d51aa0fd659c53758a2bcedb2e63f714d6273395c30
- MD5 000939dc66756fdb819fcc14ff52a8ba
- SHA1 947400fbe51bf74512f18d459b23c1b098975191
- SHA512 4751a1c755ae94da64206ce0c7a7bc0fc8958e13e783a539d56db05d9fbef32782ae5823691f9134b094f3e177ee309d29f67c3ed104838e21358ee0cfb2ab8b
- SSDEEP 1572864:PMIQN5qMkwQSy4PlGLW3OWjTSQ6AUNsNNlwPTLcIFvBKQjuKWRhbW2rXc:PMIGXlLXSfAUC6PX9vRjuKWRhbWGs
- TLSH T154282292A2EC20B8D67AC1788566D11FEB713C1D53246AEB23E0BE193F377D119B9311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4540 Davetrap.exe 4540 Davetrap.exe 4540 Davetrap.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\shell\open\command Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\URL Protocol Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Davetrap\\Davetrap.exe\" -player \"%1\"" Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\DefaultIcon Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\DefaultIcon Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\ = "URL: Roblox Protocol" Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Davetrap\\Davetrap.exe\" -player \"%1\"" Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\shell Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\ = "URL: Roblox Protocol" Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\shell Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\shell\open Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\URL Protocol Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Davetrap\\Davetrap.exe" Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\shell\open Davetrap.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Davetrap\\Davetrap.exe" Davetrap.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\roblox-player\shell\open\command Davetrap.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4540 Davetrap.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4540 Davetrap.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Davetrap\ndjAXUZpzIyA\D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 320565434e5d8a77e13980e9c0e641daa08d12693ac0d77df9ccf2b25d9e526c
- MD5 20d9ebd5020c322365d11bfe49740609
- SHA1 0c4248028be99dd04c48428537d98c19b20f12fb
- SHA512 05c98a4ae88e305ca02c961526fb7a947036a197ab8d564fa9f530325192233b1285dd3880467db89f3f8a77b84f674c6c1716ad8e62b7b74a4db32d599578b4
- SSDEEP 49152:y6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3h/d:yUdeqt737jFmRtF
- TLSH T177268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\Davetrap\ndjAXUZpzIyA\PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 0002f81ee5c803cb90329f2ab08556fd6de29d1ddd6d83446d1d4c19748f25e8
- MD5 5abba52442f893f51903867a984309a8
- SHA1 935e25fd68702de5b41ffdbd89be7c74e0a35d98
- SHA512 63791cb693e4abda219c6f0df951c3b91e8dbc19bf2fb2caec091fa62bca8d91044cba77979e9a690138354676e7cea1a3a320b38b06ab0366d6830092455a99
- SSDEEP 24576:agaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPnFR:rnR+g8lYP00OM8zT3GbNUdvoxWZBlIue
- TLSH T163453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\Davetrap\ndjAXUZpzIyA\wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 905625129daab0f6dee6c6d2e95beb47f24590b8d9022392fa4440e9d2957402
- MD5 76bb2f5f63ae6f99b58a1a5f0bfbc38e
- SHA1 7362d1303d3ae8dd93deeea2e4a43f1894e0d36b
- SHA512 705a01621a614656fa8d1013d5413c2044a0e14ca4b912bc6ab7f9133d6447e08d3a633fc727d5adb9ec56efb3dd328f1cc476c38d41c7e1777dd8b7622f390d
- SSDEEP 24576:6Iq/d8FBpNk3uQA2F6QB8jObZ7qtiFAdW8SRPTi2A6qTy5IvsEm5b6pSLdZ+c:r3s+QA2SObh9aWd9maqTy5ksEe+c
- TLSH T108954A46B6EC40E9D47AE23CDAD7861BF27178102761A7CF23A0479D6F27BD0097A361
- MD5 SHA1 SHA512 SSDEEP TLSH