Overview

overview

7

Static

static

3

Masterstrap.exe

windows10-2004-x64

1

Masterstrap.exe

windows11-ltsc_2024-x64

1

Masterstrap.exe

windows10-2004-x64

7

Masterstrap.exe

windows11-ltsc_2024-x64

6

Microsoft....re.dll

windows10-2004-x64

1

Microsoft....re.dll

windows11-ltsc_2024-x64

1

Microsoft....ms.dll

windows10-2004-x64

1

Microsoft....ms.dll

windows11-ltsc_2024-x64

1

Microsoft....pf.dll

windows10-2004-x64

1

Microsoft....pf.dll

windows11-ltsc_2024-x64

1

WebView2Loader.dll

windows10-2004-x64

1

ZstdSharp.dll

windows10-2004-x64

1

ZstdSharp.dll

windows11-ltsc_2024-x64

1

runtimes\w...er.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Masterstrap.exe
  • Size 213KB
  • Sample261024-tkwe2szy7k
  • SHA256 3e01371b1b14c810037d23628669491864ffa51a0bf766c4c33b92d1e7f7a40e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Masterstrap.exe
    "C:\Users\Admin\AppData\Local\Temp\Masterstrap.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Masterstrap.ico
        • Path C:\Users\Admin\AppData\Local\Masterstrap\CursorPack\Masterstrap.ico
        • Size 65KB
        • SHA256 925dfb0ea89acc2585e8fd2d1b8731153fac12d305c62e26ffdb7d4b8d9ed773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Masterstrap_runtime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Masterstrap_runtime.log
        • Size 248B
        • SHA256 c4d5ed8ff7d01bf4539d57d116b4b5c602a9cd282682c81a857015f52761f768
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        account-manager-ui.json
        • Path C:\Users\Admin\AppData\Roaming\Masterstrap\account-manager-ui.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512
        Submit Download

        settings.json
        • Path C:\Users\Admin\AppData\Roaming\Masterstrap\settings.json
        • Size 7KB
        • SHA256 7a722cd0003da337f39f68d2de2525aa3a931eecf5e69a80053dbce8d97550be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download