Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 14:04
General
- Target MasterstrapSetup.exe
- Size 7.9MB
- Sample260809-rdrr6ssvaw
- SHA256 a12304d3ed387954d8acfe31b29abb1674c0708b5abcf69d8cb04f22c3fcb3c0
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 18 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MasterstrapSetup.exe"C:\Users\Admin\AppData\Local\Temp\MasterstrapSetup.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.exe"C:\Users\Admin\AppData\Local\Masterstrap\Application\Masterstrap.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
System.ComponentModel.dll
Masterstrap.deps.json
Masterstrap.dll
Masterstrap.exe
Masterstrap.runtimeconfig.json
System.Security.Cryptography.ProtectedData.dll
sky512_rt.tex
sky512_bk.tex
sky512_dn.tex
sky512_ft.tex
sky512_bk.tex
sky512_dn.tex
sky512_ft.tex
sky512_lf.tex
sky512_rt.tex
sky512_up.tex
FFlags.hpp
Offsets.hpp
meta.json
account-manager-ui.json
settings.json
memory/1152-203-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-52-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-39-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-35-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-168-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-170-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-219-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-173-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp
memory/1152-174-0x000001C5D45C0000-0x000001C5D4A78000-memory.dmp