Overview
overview
3Static
static
3modapi-202...26.zip
windows11-21h2-x64
1Ionic.Zip.dll
windows11-21h2-x64
1ModAPI.exe
windows11-21h2-x64
1ModAPI_Shared.dll
windows11-21h2-x64
1Mono.Cecil.Mdb.dll
windows11-21h2-x64
1Mono.Cecil.Pdb.dll
windows11-21h2-x64
1Mono.Cecil.Rocks.dll
windows11-21h2-x64
1Mono.Cecil.dll
windows11-21h2-x64
1Portable.S...le.dll
windows11-21h2-x64
1System.ValueTuple.dll
windows11-21h2-x64
1Updater.exe
windows11-21h2-x64
3libs/AsyncBridge.dll
windows11-21h2-x64
1libs/BaseModLib.dll
windows11-21h2-x64
3libs/I18N.CJK.dll
windows11-21h2-x64
1libs/I18N.MidEast.dll
windows11-21h2-x64
1libs/I18N.Other.dll
windows11-21h2-x64
1libs/I18N.Rare.dll
windows11-21h2-x64
1libs/I18N.West.dll
windows11-21h2-x64
1libs/I18N.dll
windows11-21h2-x64
1libs/Ionic.Zip.dll
windows11-21h2-x64
1libs/Syste...ng.dll
windows11-21h2-x64
1libs/UnityEngine.dll
windows11-21h2-x64
1libs/polyf...ge.dll
windows11-21h2-x64
1libs/polyf...ng.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/08/2026, 02:48
Static task
static1
Behavioral task
behavioral1
Sample
modapi-2026_08_18_04_47_26.zip
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
Ionic.Zip.dll
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
ModAPI.exe
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
ModAPI_Shared.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
Mono.Cecil.Mdb.dll
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
Mono.Cecil.Pdb.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
Mono.Cecil.Rocks.dll
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
Mono.Cecil.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
Portable.System.ValueTuple.dll
Resource
win11-20260513-en
Behavioral task
behavioral10
Sample
System.ValueTuple.dll
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
Updater.exe
Resource
win11-20260513-en
Behavioral task
behavioral12
Sample
libs/AsyncBridge.dll
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
libs/BaseModLib.dll
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
libs/I18N.CJK.dll
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
libs/I18N.MidEast.dll
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
libs/I18N.Other.dll
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
libs/I18N.Rare.dll
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
libs/I18N.West.dll
Resource
win11-20260513-en
Behavioral task
behavioral19
Sample
libs/I18N.dll
Resource
win11-20260513-en
Behavioral task
behavioral20
Sample
libs/Ionic.Zip.dll
Resource
win11-20260513-en
Behavioral task
behavioral21
Sample
libs/System.Threading.dll
Resource
win11-20260513-en
Behavioral task
behavioral22
Sample
libs/UnityEngine.dll
Resource
win11-20260513-en
Behavioral task
behavioral23
Sample
libs/polyfills/AsyncBridge.dll
Resource
win11-20260513-en
Behavioral task
behavioral24
Sample
libs/polyfills/System.Threading.dll
Resource
win11-20260513-en
General
- Target Updater.exe
- Size 107KB
- Sample260818-daw1tsvbph
- SHA256 c2beb9f7b41c9605dfdbcbbd95dddf2e96ba59c38627b2e07167a0d963bf81a9
- MD5 176bf1eadeffbc0dda7507ec49cfb9da
- SHA1 e7f69d983c060768054d5c8f186d93f984e9be59
- SHA512 44625832831d9427c580a4cc63d01a4771164087349a3d07e9731343d633e84280efaecc27f5ffdfd7584601d442cdae17ad37c97c2c10f45638a27e147ac517
- SSDEEP 768:mGzJ5vPda3fgosiHAm0cjabanaHbhfrmFz3wyyBButCf7woVcB:9fvPE34riHAmTm+aHbhDmxAPukU4c
- TLSH T18DB36D9A673D8421DC18B5F23A5246D50E78AF7A31AD8132F075B8073978353DE0FA6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Updater.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1264 Updater.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1264 Updater.exe