Overview
overview
7Static
static
3oakbough-f...up.exe
windows10-2004-x64
7oakbough-f...up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ID.dll
windows10-2004-x64
3$PLUGINSDI...ID.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3stemmafiles-cli.exe
windows10-2004-x64
1stemmafiles-cli.exe
windows11-ltsc_2024-x64
1stemmafiles.exe
windows10-2004-x64
1stemmafiles.exe
windows11-ltsc_2024-x64
1uninstall.exe
windows10-2004-x64
7uninstall.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/09/2026, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
oakbough-family_0.11.0_x64-setup.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
oakbough-family_0.11.0_x64-setup.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
stemmafiles-cli.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
stemmafiles-cli.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
stemmafiles.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
stemmafiles.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
uninstall.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
uninstall.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260911-en
General
- Target stemmafiles.exe
- Size 43.6MB
- Sample260926-tk4resfa44
- SHA256 5956fa6c48ca106b6565aa79ff66c5ee1c04fc06f96040e4e07c485fb980258d
- MD5 1450ca95ee4088ef8e1cc2a8848d3b05
- SHA1 ed1fe9cd35ce117d0b49f6fd032044c6961f924e
- SHA512 14d3ab535b29924c5ef2bd86964f941e1105c3173e7b1adb13ad89e8c6d0936fd13c085b26c09af60e5f01134988041e2040623275d0e3985a8953cc3664eb88
- SSDEEP 786432:F1ETiFgTR7OMHTglJ0w8UmayIG260KmOHlt5:F1EA8NOMHgg31L1R
- TLSH T173A76B02B69F94ADD19AC8B083468A73AF2134DB0625B9FF41D456343FBEBE05B38715
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4124 stemmafiles.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4124 stemmafiles.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\oakbough-family\config.toml
- Size 180B
- SHA256 1a3a184dd04348409983bf2ecdef3ee6b22c8b8868eca6cc08ef598a8ce54f0d
- MD5 d899686384e485d1dc640a7740c4a3a5
- SHA1 5d416360803c2f3a72b38c9894db6ebcbfe9315e
- SHA512 654c5ec8403552de4209c461181ae59d8ee91078e898efebc4f2764d0e3397394b6160dba958c49b2e1d313e746a00c161d7d3341c3aaa98d2ee6743216932f3
- TLSH T1D5C0C02E00EFEA040025B948CC21CF0341F2B2B0C0AC148A21FD804C147880CC09445E
- MD5 SHA1 SHA512 TLSH