Overview

overview

7

Static

static

3

t9_mod_man...er.exe

windows10-2004-x64

7

t9_mod_man...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    39s
  • max time network
    43s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/09/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    t9_mod_manager_installer.exe
  • Size 37.5MB
  • Sample260919-ysbstsbe96
  • SHA256 4930707269d02fd5654170c2c01a12c33ccbf38687bfae501310ab353209f856
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\t9_mod_manager_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\t9_mod_manager_installer.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\T9ModManager.exe
      "C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\T9ModManager.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\Qt6Core.dll
        • Size 10.0MB
        • SHA256 fae4778a42e93adc82b831c879c886a05147e9cc26760808d21116be5547259b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 8fceee959a670372aaa5763287c2ef7924cd9ecdbe2c29cf4b6c12a63079c503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Network.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\Qt6Network.dll
        • Size 1.7MB
        • SHA256 0232076731e386b6cc353bdf743d5fb17e95a3493c2d02afac984db87ed47b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 4d603bff620ae0830d15c25a787f9f10ed3f972d998f1f17c9c4f83937280399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        T9ModManager.exe
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\T9ModManager.exe
        • Size 4.0MB
        • SHA256 15ba4a9fd712469df8dd578f0ddb86a204326728879df3547a2fafcf5d249041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvgicon.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\iconengines\qsvgicon.dll
        • Size 70KB
        • SHA256 dcfe12e028e1fd694a99fbc18f6aebf08d36223f5fd99c1bc1e7bc85eee11281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qgif.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\imageformats\qgif.dll
        • Size 46KB
        • SHA256 1ac71f48e08ee0aa405d55041f8340d56ed827fb94260bceda46ac0a50dfb7a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qico.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\imageformats\qico.dll
        • Size 44KB
        • SHA256 0eb08bc9d8f6c1ab05f3a837629eb10e41eb6aa72240d23e291056b801894794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qjpeg.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\imageformats\qjpeg.dll
        • Size 564KB
        • SHA256 bc3815c58443a01f43417ecac74bbf182c245d433ea82af0b3dc669c2cb064ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvg.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\imageformats\qsvg.dll
        • Size 38KB
        • SHA256 8a4db91d1cb7689554794e93a9b0811fdffecfa43fc8c703049092ca27097ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\platforms\qwindows.dll
        • Size 983KB
        • SHA256 dd126e2a47f7f3d4a855981e9d4012076058b1440f6900b9a07aa950e4e4f20a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmodernwindowsstyle.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\styles\qmodernwindowsstyle.dll
        • Size 225KB
        • SHA256 093e3ac68dfdac52a2667a2f7ba00b336392f9d6bde08430494ef54dbd120541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qcertonlybackend.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\tls\qcertonlybackend.dll
        • Size 101KB
        • SHA256 c1fa08ef8f0ea33370ad8e1239d9147262b08d002edab4bc4e9812827381dbba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qschannelbackend.dll
        • Path C:\Users\Admin\AppData\Local\Programs\T9 Mod Manager\tls\qschannelbackend.dll
        • Size 257KB
        • SHA256 b263e588f2a93955a3e42b2c0d893d203cbe5a0ac42d1af5840ddd3b9a16b183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3996-289-0x00007FF7AC2B0000-0x00007FF7AC6BF000-memory.dmp
        Download

        memory/3996-291-0x00007FFB67AF0000-0x00007FFB6813D000-memory.dmp
        Download