762a17a89d21b03dfdf273e68326dcc8a641f7014b3b260c7c93e01f327c43a8

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stilldawn-Windows-x86_64/stilldawn.exe
Size 20.0MB
Sample260930-vrm8patfld
SHA256 762a17a89d21b03dfdf273e68326dcc8a641f7014b3b260c7c93e01f327c43a8
MD5 84f7a398427d28da80d32d1167547e5b
SHA1 6ce69e9bebdc47c9cbf8b2fd0fed6e10d37482f4
SHA512 c54909dad9406b43c1bc6f9a30964f3369236cf33353b6504a95ea86ad897acd7ebcae64a6446fa282df0c16fd022f0e8e297f4de7641588d70051ceedb3021f
SSDEEP 98304:oHiPAuUTbXdtG3MVTDCxHCKp88g7MY9sEbgExxrSdkD9MJYt7p8Vk8jbuEb:fVGTdHC9Cb99xrNDNmk8fLb
TLSH
T1F8277B47FC6618E5E1AEE431C562A523BB303C590B3263EB5B80F6243F3ABD059B9754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	stilldawn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	stilldawn.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	stilldawn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	stilldawn.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	stilldawn.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3604	stilldawn.exe

C:\Users\Admin\AppData\Local\Temp\stilldawn-Windows-x86_64\stilldawn.exe
"C:\Users\Admin\AppData\Local\Temp\stilldawn-Windows-x86_64\stilldawn.exe"
1⤵
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audio.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\audio.pak
Size 7.8MB
SHA256 0ad87b335fe853f8b17c6d7e38394d3402e3f2c9c70ba4f2115f72b01d5ef7ce
MD5 f21734a2a5166180f3a5b477ef936734
SHA1 58867dfa632986e96692bb9a64c0bb3d7d269ccf
SHA512 0e535f5f3d60b644a0ab4476cd907ac8fd00642af7023dc7eade984d1fc85287462afb9f7fbdd0230752bfe0cdcf56f23c5f14c6c69fce540a44b8e4c46e74fb
SSDEEP 196608:C20x5LyehCrsjtw5lrNWenTmdh52mtz2PwV9TV6YCl7qurl:C2/mCrow5F4enahYmtz2PwV9Tt075
TLSH
T1548612A3E1438500E98B4B32DED36A040E60BD1DFDB9692F314CBD45E7B338175667AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boar.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\boar.pak
Size 38.2MB
SHA256 c15160526465edaa643305aafb658eab13811b96b83ca406b5860dd72de3f772
MD5 3b5d4b55637604bac5463b42a5554efa
SHA1 1e41cccbccc4a20f947f13fb7cfe17d78a0122d8
SHA512 274499bab5f76ea9ff87217e887f93bc0763598f86fcce0767ef771d89a0db923e4fe0c51348959e91a27da117d7849fe8d3dbd3558a0a0333719a3fb73823a8
SSDEEP 786432:QU13EeHQAc7R1ypmtpc2ug0ftrCRbeab+A2xfQ0hXSY8Dbxq1H+2pK:R3E62RIItMg0KqBhXSY8DbxqUmK
TLSH
T16897334538702E63B15C3067C1E116607452CC352A299AB8AF63F7D73BB1AC1EEB639D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

catalog.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\catalog.pak
Size 3KB
SHA256 6ac7fccc7712ded17e1e964bf6987f8976cb3ae3eb5bdf5ad6bce26e84d12814
MD5 ad66edc95fda5c6cbb2f8ff3fd7d1a60
SHA1 dffee348d243ae24cc6b4e2b192be6578115a807
SHA512 2066cf458c8dd40ceeca01ea74427279d5cca87a056ab0901549590c20e0cb7a7ac2ca80d9b2ce392bf51f4afc6927adfe7b8efdf9c230e0c689cd182ab354b9
TLSH
T1D1815CDA20824C1CEC3E4C7CA655478C3961368FC92B62596C94822CD2AF27776DEB77
MD5 SHA1 SHA512 TLSH

Submit Download

lantern-woodlands-art.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\lantern-woodlands-art.pak
Size 22.8MB
SHA256 4321c6dab06de645736b07d6f489dc46b250d2ca6d174708c69360d5f5580efe
MD5 cf6618920462474370cdd3072d0dee28
SHA1 43df239ba93afc653a76d459fd89a31c7865dc08
SHA512 6922d56b809d7e2321388792e8bf2885fc49a75f551150bb705950825198378d3b66ffa45ca5c1d492ac06a81703643bfc14d33f78bda1bc46607cabf5282269
SSDEEP 393216:eiFTGHsGW58fZ/hTm2bEVcoewVIZPeooS9jJQIYs5uGfgbMbEAoNxFNgngBvhkXK:eiFT+Wih5EVFVIZPeoZqI2bjA8llqYeU
TLSH
T17337330D2153BD1ED27795FA0AB5FA56CA683E77784F6C579C2800A24CB6D8D6A03F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lantern-woodlands-world.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\lantern-woodlands-world.pak
Size 155KB
SHA256 8aebd7aa0c578c3af6903c79b50e2f4403a89822366619c2261c7a0edb68e576
MD5 1ebaf50e5ea9c6b7e10497eacfbb39ad
SHA1 a3c97e3d3a389c2f76ae3410d7a46de13b130c9a
SHA512 dcd953f6ef321fd765aacceb841167c781182eeaa06af94d145ea09da101f2cb60c92f267dfde55127bb1a02d1044411cb5247a6de7c0adba00505c7c1343843
SSDEEP 3072:d2XdSYnlSiS9lb8Amgmp7Uh6kIdKT3AybfNt62mSdOnmfkiocOj1R:dkHnlSTIAmgmycLoBbf/5omMEOj1R
TLSH
T19BF31221963E7752F07FA052E1673F583750E52B6863A83BA31208C997B83DD879BE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rabbit.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\rabbit.pak
Size 3.0MB
SHA256 b151d33f3fabd9c899bceb6965eb6e04d7980f9234588a00d176e8e25f51c4cd
MD5 ca139aefdc7bdd6240a9caa8477e271b
SHA1 8bda21a9dd687658678db594d0a0e4669dbd505a
SHA512 0a88a4e57f3eb3d8ab56f84767b1b54f4337499fa83453cfd81ccc8eccc161dd4ea475cbc43595437a81a41b971ecab28aa3c0cc76698be4305008d78b7ba1b7
SSDEEP 98304:gLoBoYkAG8BaTkyzbdibfTNt+9jF1BukBi:4NYNPyzbdGTNt+9jXBi
TLSH
T1E8E533206E0351F2EF67C5F8BB9031BB171ADF1FD72957CA9A943947E41B6A2C1043A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranger.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\ranger.pak
Size 49.3MB
SHA256 6ab6e9d294c22fe10e55cd2c1c8a5b3521295ef53caf040cbaad3ec5bd3a3cff
MD5 6e00cc17fa1a69d54aceb3ed7d1d5692
SHA1 3e2b7da92ce9262e5461e2c21f2086b05ab76d5a
SHA512 a6de25f658e3186b22f26699c0485144cdd61a483b7cf48b081da4f678f522078ef6bf419ca9db1c6a48ffef7e768f989cd08f0838a36360a6a3ac0bab5932c4
SSDEEP 1572864:dnjQ/sOSb/Byz71NhJ9kfFbGqY54awR3BOg3RINw2B:F5PEz7hyFb1Y1c30MGNww
TLSH
T197B733A3E34F6862C263B43E46524095F130CC2B6FE50D73B2254F35BA72AE57E49B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rogue.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\rogue.pak
Size 45.4MB
SHA256 a4d559000a2d0e7e8d2d55aeff4961d01427dcd4762eeabe19c2234f5d10f121
MD5 696ed43e63465daffd0dc6571ff606fe
SHA1 1d23ba6604ce1aa5ab09edae11b0ab8f32cbe578
SHA512 ccb515cf9d985533e02eafcfd5b92dd7f037b64c256c701fe421979c09c33c204786b0fc7512e0b69a948de0dcc46b692572f373e7ebeb81fa8bc097ef0d7eb0
SSDEEP 786432:gNo6USxg9JmqNB9PKClohWrrfK0CEel0dsygqwRcBVxds/ILs+XIckN2xqxa73:o6RvPKCohW/K0feidCtRcB3WgLTI5QwS
TLSH
T195A7336B13E9D9A0CC3DB97946522230FA315E2F4F926F565E6282207F5B5D0F8F821C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.pak

Path C:\Users\Admin\AppData\Local\stilldawn\assets\.download-3588773774\full\ui.pak
Size 4.6MB
SHA256 0c33cf048d4f1f9b16c515dc5aa899df2ddc665292499cf8435df61aad1f8d96
MD5 cb2fe3b7c8a5d8e75f72a58d0888756b
SHA1 65cd16d8f32dd1a7f3c53c0da9190c2054dbcf2d
SHA512 ea9b4abbc220a57088e2c17683e74fa50581b00ebe568e0c07e23075a6c4febf8dc9d39a0f8c3060ed36484250766cf8a1ee1d6002ce983fbfffdc70665dfa30
SSDEEP 98304:Yfti+TMYe+dBqjD4q1Q7akbdk7LQhwKacxrPBs0Hwf8E0ljDR4gsp:YfEDAq6tbdkPQhw5su0E0ljDDW
TLSH
T12B2633F448282056D358C4AA897266AFE7C5BE42B38FB13DF319B3618830473DD9B55B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads