Overview
overview
7Static
static
3Installer/Setup.exe
windows10-2004-x64
7Installer/Setup.exe
windows11-ltsc_2024-x64
7Installer/...64.exe
windows10-2004-x64
6Installer/...64.exe
windows11-ltsc_2024-x64
6Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Installer/...64.exe
windows10-2004-x64
6Installer/...64.exe
windows11-ltsc_2024-x64
6Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Analysis
- max time kernel
149s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 15:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer/Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer/Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Installer/utils/HidHide_1.5.230_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
Installer/utils/HidHide_1.5.230_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installer/utils/VC_redist.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installer/utils/VC_redist.x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
- Size 6.0MB
- Sample260815-svs71adn3y
- SHA256 89220a7865076b342892f98865f3499fb7c4cfd673159e89d352c360fd014c6a
- MD5 a62717e3e4306de1dca4fb5c2fa0ac6c
- SHA1 5ec1b1077b43e82c2d3712909c7ed80dd59504dd
- SHA512 960b2cf7d3e301fc8a260ed49a136ffe8c1e30406a4eb64b7ceeaf7f56f33bbb5153825670258a2e254d3dbdb09c0f0f4abffcbb70395416f213a0e2b8061366
- SSDEEP 98304:shxzP3MqBfTluw4yctnfZeos/9/5oe3UOv2NkHLcgpn78NpoEXBhLlvRJSvr0/Pr:s/PdfTUHNY/5oe3UdNWVx78NpBXBhETS
- TLSH T1E756AE31724AC53BD96211B11A2C9E9F612CBE350BB254C7B3DC2E6E1BB54C21736E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\Q: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\H: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\N: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\J: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\T: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\W: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\L: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\O: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\S: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\U: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\X: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\Y: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\R: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\V: ViGEmBus_1.22.0_x64_x86_arm64.exe File opened (read-only) \??\Z: ViGEmBus_1.22.0_x64_x86_arm64.exe - Loads dropped DLL 10 IoCs
pid Process 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe 4332 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViGEmBus_1.22.0_x64_x86_arm64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2656 msiexec.exe Token: SeCreateTokenPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeAssignPrimaryTokenPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeLockMemoryPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeIncreaseQuotaPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeMachineAccountPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeTcbPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSecurityPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeTakeOwnershipPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeLoadDriverPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSystemProfilePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSystemtimePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeProfSingleProcessPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeIncBasePriorityPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreatePagefilePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreatePermanentPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeBackupPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeRestorePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeShutdownPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeDebugPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeAuditPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSystemEnvironmentPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeChangeNotifyPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeRemoteShutdownPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeUndockPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSyncAgentPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeEnableDelegationPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeManageVolumePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeImpersonatePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreateGlobalPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreateTokenPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeAssignPrimaryTokenPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeLockMemoryPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeIncreaseQuotaPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeMachineAccountPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeTcbPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSecurityPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeTakeOwnershipPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeLoadDriverPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSystemProfilePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSystemtimePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeProfSingleProcessPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeIncBasePriorityPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreatePagefilePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreatePermanentPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeBackupPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeRestorePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeShutdownPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeDebugPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeAuditPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSystemEnvironmentPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeChangeNotifyPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeRemoteShutdownPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeUndockPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeSyncAgentPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeEnableDelegationPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeManageVolumePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeImpersonatePrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreateGlobalPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeCreateTokenPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeAssignPrimaryTokenPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeLockMemoryPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeIncreaseQuotaPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe Token: SeMachineAccountPrivilege 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4276 ViGEmBus_1.22.0_x64_x86_arm64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2656 wrote to memory of 4332 2656 msiexec.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer\utils\ViGEmBus_1.22.0_x64_x86_arm64.exe"C:\Users\Admin\AppData\Local\Temp\Installer\utils\ViGEmBus_1.22.0_x64_x86_arm64.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4276
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C1D6BA839CB65A7B36A4DA1F95A7565 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4332
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Nefarius Software Solutions\ViGEm Bus Driver 1.22.0\install\A4E9077\ViGEmBus.x64.msi
- Size 2.1MB
- SHA256 ac457244aa5d2cbebd05522c28fa8b483f06ee47c38ee3e701e7d16546dde19a
- MD5 09f2bfb2532b4ffe0df8a82233ba6a00
- SHA1 cae2265f65f3b8ad578d147de52129e1fb9073ee
- SHA512 1ce6370f19f7f1cd15f269cf4355aa942dd51041d2e859a9a5271d92d3814ab32e3753260c919f1dde4b512676f9cbc60e1cd85d875d41d7b9d8ab41d6190465
- SSDEEP 24576:6+mxAd5a6G6kth0lhSMXllYY5nrlprRQ+MtZwNSEK/kRh0lhSMXltw5J14s8rKS:6+DkEP5nrBM34SHc4W5J14s8rb
- TLSH T1C9A58D21B287C136D66D02B2B92CEF6E1578BF730B7100E777D8796E58B08C26275E16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4276\banner.jpg
- Size 4KB
- SHA256 be83c8592906fd9651634b0823a2f45abe96aae082674568944c639b5b4a95dc
- MD5 d5a55a78cd38f45256807c7851619b7d
- SHA1 9d8269120d1d096e9ab0192348f3b8f81f5f73d9
- SHA512 959e7410e3006cfef9d14315e8741e34b6e81c4f9160c5d66f3abd77ce72f55f907ab3a0e500780b5c0e0e017e8639f135cc258976b4ab4b9d1aaed6242ce9f1
- SSDEEP 96:gf2mCSVa8l5M3QXr1yFk1Erk/Sp3ErJE97KT6Avg+y5rls/Xx:I88oAXQk1Erk/Sp3ErcAvBy/wh
- TLSH T10D916E7FBAC02317E9C6CA6A3DAE8017561108F168F0E63508CFCDD3D93919B596A1E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4276\dialog.jpg
- Size 12KB
- SHA256 36d9bab35d1e4b50045bf902f5d42b6f865488c75f6e60fc00a6cd6f69034ab0
- MD5 5f6253cff5a8b031bfb3b161079d0d86
- SHA1 7645b13610583fb67247c74cf5af08ff848079e7
- SHA512 d1fdc364bedf931512000fbf05e854d5aceccb48abb9ec49e68476a5dc2907267490290d92acbb267ffb7bdba9b7a1c88f1eb77830cf953443f4624995dabdc3
- SSDEEP 192:zBi8rcWUMevBUahRXMHd0q3vkf6kx2DJIQ4EALOCwTx5D+CM96qdGi131:48IzMiBUaEHdp3vkCXuQ4pnH1dGiz
- TLSH T1E8429E6D0FAAF167D61123F061F3AFFF2F677E020A9000915DC6E593EB501A10D6C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB2E1.tmp
- Size 719KB
- SHA256 a412b642de0e94db761ebd2834dde72eed86e65fc4a580670a300015b874ba24
- MD5 c9c085c00bc24802f066e5412defcf50
- SHA1 557f02469f3f236097d015327d7ca77260e2aecc
- SHA512 a6fa1f34cd630a7509a6441be7ad060de7e039967d2ec015e27c2a643b04e0eecf53902b7173c4c2e92e3a890bd7acb6a3307d9923838f0bfc71496fb184b1de
- SSDEEP 12288:/5rDyzf/qG8B/1S9xHph0lhSMXlek9OY5nrG:9a6G6kth0lhSMXllYY5nrG
- TLSH T1C7F46C203685C03AD66E45B029ACCBAB55697E764B7218CB73C86E3E19F18C39735F13
- MD5 SHA1 SHA512 SSDEEP TLSH