Analysis
- max time kernel
30s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 00:45
General
- Target HotspotShield-12.14.1-plain-773-plain.exe
- Size 28.1MB
- Sample260807-a3721sdn21
- SHA256 7a04a9886ec1d530872b2a6ce62689fcc312772bb88c2f506a0e4e50a341a3ae
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 35 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe"C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{C80EBF43-A811-4595-8B8B-EC55B9ABB608}\.cr\HotspotShield-12.14.1-plain-773-plain.exe"C:\Windows\Temp\{C80EBF43-A811-4595-8B8B-EC55B9ABB608}\.cr\HotspotShield-12.14.1-plain-773-plain.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe" -burn.filehandle.attached=692 -burn.filehandle.self=7002⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tmp4E84.tmp
Tmp4ED4.tmp
BootstrapperCore.config
BootstrapperCore.dll
Foundation.Composition.LightInject.dll
Foundation.Composition.dll
Foundation.Installer.Common.dll
Foundation.Installer.Diagnostics.dll
Foundation.Installer.UI.dll
Foundation.Logging.Dummy.dll
Foundation.Logging.dll
Hss.Setup.Bootstrapper.dll
Hss.Setup.Common.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.Deployment.WindowsInstaller.dll
Newtonsoft.Json.dll
System.IO.Abstractions.dll
System.Memory.dll
System.Threading.Tasks.Extensions.dll
Trinet.Core.IO.Ntfs.dll
mbahost.dll
HotspotShield-12.14.1-plain-773-plain.exe
memory/4552-129-0x0000000007290000-0x00000000072BE000-memory.dmp
memory/4552-151-0x0000000007520000-0x0000000007528000-memory.dmp
memory/4552-118-0x00000000076D0000-0x0000000007C8A000-memory.dmp
memory/4552-119-0x00000000071F0000-0x0000000007282000-memory.dmp
memory/4552-123-0x0000000007350000-0x0000000007402000-memory.dmp
memory/4552-117-0x0000000006FA0000-0x0000000006FCA000-memory.dmp
memory/4552-113-0x0000000006E90000-0x0000000006E9E000-memory.dmp
memory/4552-130-0x0000000007410000-0x0000000007476000-memory.dmp
memory/4552-109-0x0000000006EB0000-0x0000000006EDA000-memory.dmp
memory/4552-131-0x00000000072F0000-0x0000000007312000-memory.dmp
memory/4552-135-0x0000000007320000-0x0000000007332000-memory.dmp
memory/4552-105-0x0000000006F10000-0x0000000006F96000-memory.dmp
memory/4552-139-0x00000000074B0000-0x00000000074D6000-memory.dmp
memory/4552-101-0x0000000006BC0000-0x0000000006BCA000-memory.dmp
memory/4552-143-0x00000000074E0000-0x00000000074F8000-memory.dmp
memory/4552-147-0x0000000007510000-0x0000000007518000-memory.dmp
memory/4552-97-0x0000000006BB0000-0x0000000006BBA000-memory.dmp
memory/4552-93-0x0000000006BA0000-0x0000000006BAE000-memory.dmp
memory/4552-89-0x0000000006BE0000-0x0000000006C7C000-memory.dmp
memory/4552-85-0x0000000073130000-0x00000000738EC000-memory.dmp
memory/4552-152-0x0000000007690000-0x00000000076A2000-memory.dmp
memory/4552-156-0x0000000073130000-0x00000000738EC000-memory.dmp
memory/4552-82-0x0000000073130000-0x00000000738EC000-memory.dmp
memory/4552-80-0x00000000044F0000-0x0000000004508000-memory.dmp
memory/4552-174-0x0000000007FD0000-0x0000000007FF2000-memory.dmp
memory/4552-181-0x00000000091B0000-0x00000000091BC000-memory.dmp
memory/4552-186-0x00000000091F0000-0x000000000954B000-memory.dmp
memory/4552-75-0x0000000073142000-0x0000000073143000-memory.dmp
memory/4552-190-0x0000000009820000-0x000000000982C000-memory.dmp
memory/4552-194-0x0000000073130000-0x00000000738EC000-memory.dmp
memory/4552-195-0x000000000DEA0000-0x000000000DF5A000-memory.dmp
memory/4552-196-0x000000000A8D0000-0x000000000A8D8000-memory.dmp
memory/4552-201-0x000000000A940000-0x000000000A94E000-memory.dmp
memory/4552-200-0x000000000DE20000-0x000000000DE5E000-memory.dmp
memory/4552-217-0x0000000073142000-0x0000000073143000-memory.dmp
memory/4552-218-0x0000000073130000-0x00000000738EC000-memory.dmp