Analysis
- max time kernel
300s - max time network
300s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 12:43
Static task
static1
Behavioral task
behavioral1
Sample
UgPhone_Setup_2.0.8.1956.exe
Resource
win10v2004-20260911-en
22 signatures
300 seconds
Behavioral task
behavioral2
Sample
UgPhone_Setup_2.0.8.1956.exe
Resource
win11ltsc2024-20260911-en
6 signatures
300 seconds
General
- Target UgPhone_Setup_2.0.8.1956.exe
- Size 103.4MB
- Sample261107-pyc4eaxz9m
- SHA256 fb218a4b7c65cef7d35b08d0a22bc0164b1f2efa2e6751ac7a16b1dd20456647
- MD5 8a3c37ca7cd2c7c4c81f172c374fc235
- SHA1 4ce0e647766184f58cf39786a4e4d283bf1120c9
- SHA512 196805f633ea67bd967e06209b5cc3bf47e3eb78a18a7e50868ef646e1fde3c16f51f1e49f44fd39f30eeb883afb21b65c8e0b50ed44e1035859909b086ca725
- SSDEEP 3145728:dJRJYTZnSf1r2XqiSwe5whkuXHC3OyJKYchaD:dJRPJ2XqiHpi3OyJ5
- TLSH T106383372EE2467E5E6CC7078533A4016AFF57C06074028DF1E9CBC558A362AF8D36AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3420 installer.exe - Loads dropped DLL 20 IoCs
pid Process 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe 3420 installer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3420 installer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3420 installer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3420 installer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4456 wrote to memory of 3420 4456 UgPhone_Setup_2.0.8.1956.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\UgPhone_Setup_2.0.8.1956.exe"C:\Users\Admin\AppData\Local\Temp\UgPhone_Setup_2.0.8.1956.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\installer.exe"C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\installer.exe" --package-archive "C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\package.7z"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\Qt5Core.dll
- Size 5.7MB
- SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
- MD5 817520432a42efa345b2d97f5c24510e
- SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
- SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
- SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
- TLSH T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\Qt5Gui.dll
- Size 6.7MB
- SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
- MD5 47307a1e2e9987ab422f09771d590ff1
- SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
- SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
- SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
- TLSH T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\Qt5Network.dll
- Size 1.3MB
- SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
- MD5 3569693d5bae82854de1d88f86c33184
- SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
- SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
- SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
- TLSH T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\Qt5Svg.dll
- Size 322KB
- SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
- MD5 03761f923e52a7269a6e3a7452f6be93
- SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
- SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
- SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
- TLSH T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\Qt5Widgets.dll
- Size 5.2MB
- SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
- MD5 4cd1f8fdcd617932db131c3688845ea8
- SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
- SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
- SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
- TLSH T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\Qt5Xml.dll
- Size 208KB
- SHA256 ebdf91f0310ab67a79abd2385fa428205856f81e3a753e6e47c31d5946ddd590
- MD5 5b795fa24584ed85bdb39b9d2287cd59
- SHA1 067c3c7b4ca0ecabe48d02ae2f13058517d444c5
- SHA512 116f1c331758b663a27c20e1f3f686ba8727726fd8a8b71ac52f5ac67f95b61aae595c66292c42d8e50b5c4e33157c26fc494e5802890298c684924e54acba17
- SSDEEP 3072:jBLpK7i4eNHSb35XAE8vnIjmbjYDKGOUO2S/51YpdEH4pkg7/kFBJXT9t0rLvP:tLpWi4eNyVAbvnIibjIGLepkpXTXSbP
- TLSH T1CA243B4776254296D06BC138CE5A8D07E6B3B85017639BDF81598B3A2F33FD2B87E250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\iconengines\qsvgicon.dll
- Size 40KB
- SHA256 42dde60befcf1d9f96b8366a9988626b97d7d0d829ebea32f756d6ecd9ea99a8
- MD5 313f89994f3fea8f67a48ee13359f4ba
- SHA1 8c7d4509a0caa1164cc9415f44735b885a2f3270
- SHA512 06e5026f5db929f242104a503f0d501a9c1dc92973dd0e91d2daf5b277d190082de8d37ace7edf643c70aa98bb3d670defe04ce89b483da4f34e629f8ed5fecf
- SSDEEP 768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
- TLSH T1A1137D93B75206C6E467C735D6D98A0AC972B5518B62C3CF8229C9341FB37D3783CA98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qgif.dll
- Size 38KB
- SHA256 36174dd4c5f37c5f065c7a26e0ac65c4c3a41fdc0416882af856a23a5d03bb9d
- MD5 52fd90e34fe8ded8e197b532bd622ef7
- SHA1 834e280e00bae48a9e509a7dc909bea3169bdce2
- SHA512 ef3fb3770808b3690c11a18316b0c1c56c80198c1b1910e8aa198df8281ba4e13dc9a6179bb93a379ad849304f6bb934f23e6bbd3d258b274cc31856de0fc12b
- SSDEEP 768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
- TLSH T160034B56DB7804D2E5138638C49A4E1BEA36F5615B62D7DF836680290F337D23A3C738
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qicns.dll
- Size 43KB
- SHA256 f4a229a082d16f80016f366156a2b951550f1e9df6d4177323bbedd92a429909
- MD5 ad84af4d585643ff94bfa6de672b3284
- SHA1 5d2df51028fbeb7f6b52c02add702bc3fa781e08
- SHA512 b68d83a4a1928eb3390deb9340cb27b8a3eb221c2e0be86211ef318b4dd34b37531ca347c73cce79a640c5b06fbd325e10f8c37e0cee2581f22abfbff5cc0d55
- SSDEEP 768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
- TLSH T19B135B47A7A901D1E15BC238D59A4A3AD671FA029B52CBDF0169C92C2F73BD13C7CB44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qico.dll
- Size 37KB
- SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
- MD5 a9abd4329ca364d4f430eddcb471be59
- SHA1 c00a629419509929507a05aebb706562c837e337
- SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
- SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
- TLSH T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qjpeg.dll
- Size 411KB
- SHA256 fb4e980cb5fafa8a4cd4239329aed93f7c32ed939c94b61fb2df657f3c6ad158
- MD5 16abcceb70ba20e73858e8f1912c05cd
- SHA1 4b3a32b166ab5bbbee229790fdae9cbc84f936ba
- SHA512 3e5c83967bf31c9b7f1720059dd51aa4338e518b076b0461541c781b076135e9cb9cbceb13a8ec9217104517fbcc356bdd3ffaca7956d1c939e43988151f6273
- SSDEEP 6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
- TLSH T15794F742F1616D82E3D184BCCD95DD66D3503C2D87F786FB3A95B2FA3D32AA03925244
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qsvg.dll
- Size 31KB
- SHA256 b3498f0a10ac4cb42cf7213db4944a34594ff36c78c50a0f249c9085d1b1ff39
- MD5 c0de135782fa0235a0ea8e97898eaf2a
- SHA1 fcf5fd99239bf4e0b17b128b0ebec144c7a17de2
- SHA512 7bd5f90ccab3cf50c55eaf14f7ef21e05d3c893fa7ac9846c6ca98d6e6d177263ac5eb8a85a34501bcfca0da7f0b6c39769726f4090fca2231ee64869b81cf0b
- SSDEEP 768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
- TLSH T173E25B2ADB265842E537C274E5468F16E532F4215B52D7DF422B82291FA73C23CBC35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qtga.dll
- Size 30KB
- SHA256 5b641dec81aec1cf7ac0cce9fc067bb642fbd32da138a36e3bdac3bb5b36c37a
- MD5 a913276fa25d2e6fd999940454c23093
- SHA1 785b7bc7110218ec0e659c0e5ace9520aa451615
- SHA512 cebe48e6e6c5cdf8fc339560751813b8de11d2471a3dab7d648df5b313d85735889d4e704e8eec0ad1084ab43be0ebdfbacd038aeac46d7a951efb3a7ce838eb
- SSDEEP 768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
- TLSH T12CE25C6AD7790C82E52BA274E6928E0BD532F6205B22C7CF5255821D4F7B7C27C3C399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qtiff.dll
- Size 380KB
- SHA256 825174429ced6b3dab18115dbc6c9da07bf5248c86ec1bd5c0dcaeca93b4c22d
- MD5 9c0acf12d3d25384868dcd81c787f382
- SHA1 c6e877aba3fb3d2f21d86be300e753e23bb0b74e
- SHA512 45594fa3c5d7c4f26325927bb8d51b0b88e162e3f5e7b7f39a5d72437606383e9fdc8f83a77f814e45aff254914514ae52c1d840a6c7b98767f362ed3f4fc5bd
- SSDEEP 6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
- TLSH T123847105DED049ABD876813456E7C612F3B3B4893F02CB9B9658B1343E027D125AB6FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qwbmp.dll
- Size 29KB
- SHA256 0f05969fb926a62a338782b32446ea3e28e4bfbffc0dbd25ed303fab3404abac
- MD5 68919381e3c64e956d05863339f5c68c
- SHA1 ce0a2ad1f1a46b61cb298cec5aa0b25ff2c12992
- SHA512 6222a3818157f6bcd793291a6c0380ef8c6b93ecea2e0c9a767d9d9163461b541afaf8c6b21c5a020f01c95c6ee9b2b74b358ba18da120f520e87e24b20836aa
- SSDEEP 768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
- TLSH T1DCD25B5AE76548D2E57ACB74E2D68A27DA32F1125722C7DF1266821C0F637C23C3C789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\imageformats\qwebp.dll
- Size 498KB
- SHA256 6e37acd0d357871f92b7fde7206c904c734caa02f94544df646957df8c4987af
- MD5 308e4565c3c5646f9abd77885b07358e
- SHA1 71cb8047a9ef0cdb3ee27428726cacd063bb95b7
- SHA512 ffaeecfae097d5e9d1186522bd8d29c95ce48b87583624eb6d0d52bd19e36db2860a557e19f0a05847458605a9a540c2a9899d53d36a6b7fd5bf0ad86af88124
- SSDEEP 12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
- TLSH T1F3B45B4ED5563788E56BD0B8DABD960BF6643C5C438085EB03D5F9392A33BC4663BB02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\installer.exe
- Size 1.6MB
- SHA256 4008a5ab79aa06d1fe7535168764ea61fea4c2d0088af58c53ab0e3e3d557608
- MD5 d4a0b7ba4099cc644659ad2cb55a6ea3
- SHA1 816bf391763bb5171fbfa954e09948d1e9e951fe
- SHA512 1c72de84a6ddf2aa9bad07f33e07da3912bd3b40ba76224a8ad07fdeccbffe7c642630c4677af9077d9d68a0fa19b0dbfa58c9b69f645e79693c278289a3e23e
- SSDEEP 24576:kMFD3gS1eh8VYE+89lji6+zgID4E0IKWJCtrbEj:jFD3X1eh8VYa9luMID0WJCt
- TLSH T188759D766E6442D4E1E6B238C7124602BFF17C53572086EB2E5CBE291E325EB4C397E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\platforms\qwindows.dll
- Size 1.4MB
- SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
- MD5 4931fcd0e86c4d4f83128dc74e01eaad
- SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
- SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
- SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
- TLSH T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ugphone_setup_0E59CE04\styles\qwindowsvistastyle.dll
- Size 140KB
- SHA256 d9b21182952682fe7ba63af1df24e23ace592c35b3f31eceef9f0eabeb5881b9
- MD5 53a85f51054b7d58d8ad7c36975acb96
- SHA1 893a757ca01472a96fb913d436aa9f8cfb2a297f
- SHA512 35957964213b41f1f21b860b03458404fbf11daf03d102fbea8c2b2f249050cefbb348edc3f22d8ecc3cb8abfdc44215c2dc9da029b4f93a7f40197bd0c16960
- SSDEEP 3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
- TLSH T149E33B1372A502DAC077D278C15F0517F7B3B05853128BDF426BCEA92F532A2BE39A56
- MD5 SHA1 SHA512 SSDEEP TLSH