Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 23:58
General
- Target BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe
- Size 931KB
- Sample260922-31ab7avanb
- SHA256 267737b6425f3a473e11b6051f2a95ddab5f8f6d2e6aebd2ff9033fd31d5c145
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe"C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS874BABE8\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS874BABE8\BlueStacksInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS874BABE8\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS874BABE8\HD-CheckCpu.exe" --cmd checkHypervEnabled3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zS874BABE8\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS874BABE8\HD-CheckCpu.exe" --cmd checkSSE43⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
backicon.png
change_hover.png
close_red.png
custom.png
discord_icon.png
folder.png
help_icon.png
info_icon.png
installer_bg.jpg
installer_logo.png
installer_minimize.png
loader.png
logo_text.png
setpath.png
BlueStacksInstaller.exe
BlueStacksInstaller.exe.config
HD-CheckCpu.exe
JSON.dll
i18n.en-US.txt
ThemeFile
memory/3008-148-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-150-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-166-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-164-0x00000000213C0000-0x00000000218E8000-memory.dmp
memory/3008-167-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-163-0x000000001F850000-0x000000001F85E000-memory.dmp
memory/3008-168-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-169-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-162-0x000000001F880000-0x000000001F8BE000-memory.dmp
memory/3008-170-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-161-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-159-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-154-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-158-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-153-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-165-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-147-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-146-0x0000000002F80000-0x0000000002FE8000-memory.dmp
memory/3008-145-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-143-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-142-0x0000000000CB0000-0x0000000000D54000-memory.dmp
memory/3008-184-0x0000000020D70000-0x0000000020D78000-memory.dmp
memory/3008-140-0x00007FF81878F000-0x00007FF818790000-memory.dmp
memory/3008-188-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-189-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-190-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-191-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-192-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-193-0x00007FF818600000-0x00007FF818FA4000-memory.dmp
memory/3008-194-0x00007FF818600000-0x00007FF818FA4000-memory.dmp