Overview

overview

6

Static

static

1

DS-Setup[g...o].exe

windows10-2004-x64

6

DS-Setup[g...o].exe

windows11-ltsc_2024-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    138s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 13:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DS-Setup[g1FZab4Ro].exe
  • Size 73.1MB
  • Sample260821-qlacesfj6s
  • SHA256 9a3f6e69c12cb814c45862219ecb17e9ab7744877c9da1c49f3ea046437f8fca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoveryspywarestealerupx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 43 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DS-Setup[g1FZab4Ro].exe
    "C:\Users\Admin\AppData\Local\Temp\DS-Setup[g1FZab4Ro].exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Program Files (x86)\Download Studio\dstudio-gui.exe
      "C:\Program Files (x86)\Download Studio\dstudio-gui.exe" --open-hashid g1FZab4Ro --force-run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Program Files (x86)\Download Studio\QtWebEngineProcess.exe
        "C:\Program Files (x86)\Download Studio\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=2732 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5868
      • C:\Program Files (x86)\Download Studio\dstudio.exe
        "C:\Program Files (x86)\Download Studio\dstudio.exe" --quiet=true --event-poll=select --disable-ipv6=true --listen-port=59751 --enable-rpc=true --rpc-allow-origin-all=true --rpc-listen-port=17060 --rpc-secret=4e2545f819e67f0615003dd7e04a6087 --continue=true --check-certificate=false --allow-overwrite=true --allow-piece-length-change=true --content-disposition-default-utf8=true --disk-cache=32M --auto-save-interval=5 --file-allocation=trunc --max-connection-per-server=100 --min-split-size=1M --split=20 --referer=* --max-overall-upload-limit=5M --max-concurrent-downloads=5 --bt-enable-lpd=true --bt-piece-selector=default --bt-max-peers=150 --bt-max-open-files=250 --bt-save-metadata=true --bt-load-saved-metadata=true --bt-request-peer-speed-limit=100K --seed-time=0 --enable-peer-exchange=true --enable-dht=true --dht-listen-port=59751 --dht-entry-point=dht.dstudio.app:6881 --dht-file-path="C:\Users\Admin\AppData\Local\Download Studio\data\dht.dat" --save-session="C:\Users\Admin\AppData\Local\Download Studio\data\session.dat" --save-session-interval=2 --input-file="C:\Users\Admin\AppData\Local\Download Studio\data\session.dat" --user-agent=dstudio/1.22.1 --peer-agent=dstudio/1.22.1 --peer-id-prefix=-DS-1221- --stop-with-process=1096
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2440

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Program Files (x86)\Download Studio\MSVCP140.dll
        • Size 427KB
        • SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Core.dll
        • Size 5.4MB
        • SHA256 739aab223c25441204f4b2925a8b1af80ea6a4303ddb9d587bea1a2c8fafc2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Gui.dll
        • Size 6.1MB
        • SHA256 8919da9c553240805d03105b844ac97337d7089ba3002272b3f98860b4e1d361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Network.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Network.dll
        • Size 1.0MB
        • SHA256 15901abe2b3a146e05a57b8bb7112c2a1c586f38cecd12f21151898c79d6a5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Positioning.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Positioning.dll
        • Size 266KB
        • SHA256 cc9563e933e31860a97b35d7cd3a85f93130fc0d5b58db2b4012f6a448b1c71e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5PrintSupport.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5PrintSupport.dll
        • Size 256KB
        • SHA256 5ff88c6f22ec13e9a09bfd1ffed5532a0e72af996f864b5252af0db482555868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Qml.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Qml.dll
        • Size 2.9MB
        • SHA256 5d39dec74bde22d5d91a108cfe5fedd59395bc19cbbe5ef16ff55b080db30e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5QmlModels.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5QmlModels.dll
        • Size 340KB
        • SHA256 c087fd14fb3a4565fa500dedee14e9fcc3dd2f1fcf753825b588ac49c7f85077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Quick.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Quick.dll
        • Size 3.4MB
        • SHA256 6a0394ee605734aa1efa6f0496152ab9246d7690e1eff5a3e6f7fb7071be3263
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5QuickWidgets.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5QuickWidgets.dll
        • Size 61KB
        • SHA256 a63ef5ee27c32c30249c927325fa2ce622094d63df77861d09e7d3d54d989cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Sql.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Sql.dll
        • Size 164KB
        • SHA256 5b8fecb98a2691925d94cc983ac253cab86cd8dd4056e5d6525242dbb1bc7f52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5WebChannel.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5WebChannel.dll
        • Size 100KB
        • SHA256 8f0e6b0a1bd1a412460804b37f5555c199acbc04f331c05827b49f81e608d210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5WebEngineWidgets.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5WebEngineWidgets.dll
        • Size 195KB
        • SHA256 f17e0017255a7d83f539a3993038790dd67007eae2d49430127a393fccbda1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5WebSockets.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5WebSockets.dll
        • Size 111KB
        • SHA256 1e68b5404f6dc3c3129c5f527f8601506cee09c72a49c5a81f688bfe45608ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Program Files (x86)\Download Studio\Qt5Widgets.dll
        • Size 4.4MB
        • SHA256 fda376c36e40e4ef1fdb73229197f965a1f3bc98bedbf2c8c83513ff6a3800e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dstudio-gui.exe
        • Path C:\Program Files (x86)\Download Studio\dstudio-gui.exe
        • Size 631KB
        • SHA256 0942666f4fd5eeff41f5655f10e144434d3618ace98281464e82b08949360392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dstudio.exe
        • Path C:\Program Files (x86)\Download Studio\dstudio.exe
        • Size 2.0MB
        • SHA256 935a79d7a59da0a2d9f729d4c5cc03bff07856a67735f48ea710c8137dcfdf8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.DLL
        • Path C:\Program Files (x86)\Download Studio\libEGL.DLL
        • Size 15KB
        • SHA256 d2f08d10938c5af19e034074df574b0a2aed892d58b5d3339d93680ff6b3baa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Program Files (x86)\Download Studio\libGLESv2.dll
        • Size 2.8MB
        • SHA256 3694b86a670585c86e8383a2f00217c9e0064690ce120ba8ea15e1f35fa5e5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libnatpmp.dll
        • Path C:\Program Files (x86)\Download Studio\libnatpmp.dll
        • Size 12KB
        • SHA256 558dadd9bb8809f1838e6b9ee0ed94c2b37f3f15d52c270cfd2f41ed13c35ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        miniupnpc.dll
        • Path C:\Program Files (x86)\Download Studio\miniupnpc.dll
        • Size 39KB
        • SHA256 f23ea1f6ff44ccd9ebda0c633bee25b320230aace561ca78de0f99a3ca1bb148
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Program Files (x86)\Download Studio\msvcp140_1.dll
        • Size 22KB
        • SHA256 f0fb70b0801432a89ebcc301f289c78ffb6d3f06bfb691a5782d7a309d1386c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Program Files (x86)\Download Studio\platforms\qwindows.dll
        • Size 1.2MB
        • SHA256 a2acbe1f4acad4ec6e51ee6af6cc15b2ff7c18e432958eddbb95b24e3206fad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Program Files (x86)\Download Studio\resources\icudtl.dat
        • Size 10.0MB
        • SHA256 8364e6c6bf5744357199de0de3f6ba30846ccda70288675b75059e6fd52241f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qtwebengine_resources.pak
        • Path C:\Program Files (x86)\Download Studio\resources\qtwebengine_resources.pak
        • Size 2.4MB
        • SHA256 f41d42b2447769ae2b72aa5cb2e30888b1314c491c53a6817e999a46b3da45e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qtwebengine_resources_100p.pak
        • Path C:\Program Files (x86)\Download Studio\resources\qtwebengine_resources_100p.pak
        • Size 191KB
        • SHA256 18e72ca3edea4c5caed15f5400d32c55d60ee5ecba4edbfb5195fdf256a4089f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qtwebengine_resources_200p.pak
        • Path C:\Program Files (x86)\Download Studio\resources\qtwebengine_resources_200p.pak
        • Size 250KB
        • SHA256 e08ab578081a06bfec31d6a5ed9a737c65d6c19711d21fbf26ac16af0519a76c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindowsvistastyle.dll
        • Path C:\Program Files (x86)\Download Studio\styles\qwindowsvistastyle.dll
        • Size 122KB
        • SHA256 59dbe14fdf903d2e6120a364ffe779db1f7d9ee47fee3eb033ef4ecf89015dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui.qrc
        • Path C:\Program Files (x86)\Download Studio\ui.qrc
        • Size 387KB
        • SHA256 4a96708f989995277627f1335a33fff719797c9844bd2710d8022ac7923b9b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Program Files (x86)\Download Studio\vcruntime140.dll
        • Size 75KB
        • SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Local\Download Studio\QtWebEngine\Default\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        ButtonEvent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nse8D44.tmp\ButtonEvent.dll
        • Size 7KB
        • SHA256 21c44d5409dadfa9cb0d669757b0837fb51b5f39d242c66a76ff985409b98e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nse8D44.tmp\System.dll
        • Size 12KB
        • SHA256 9a69d4c14a1191931576912e752d4fdebda6448673e753d12739a54a970508bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UAC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nse8D44.tmp\UAC.dll
        • Size 23KB
        • SHA256 e6875dc440e675678068b53d80ab871a4cb85fc8baac48bd522b2be1b277c7e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nse8D44.tmp\nsDialogs.dll
        • Size 10KB
        • SHA256 d31f0e78976c588b936f973a89f2a9dae7a43af091bd734d1360d913fe6f2b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsJSON.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nse8D44.tmp\nsJSON.dll
        • Size 29KB
        • SHA256 e904f2eba2a96aed533114aae09374d0ae88edc7f0c0cd603f44ab4acaa089f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2440-247-0x0000000000910000-0x0000000000EE6000-memory.dmp
        Download

        memory/2440-262-0x0000000000910000-0x0000000000EE6000-memory.dmp
        Download

        memory/4704-10-0x00007FF906205000-0x00007FF906206000-memory.dmp
        Download