Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 15:37
General
- Target launcher.exe
- Size 26.9MB
- Sample260415-s2vpeaev9w
- SHA256 62940036dbd9a7f5865400e57edad886fa8d12978d70c5c979e4e79311dc54c6
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\ldrupd.bin"C:\Users\Admin\AppData\Local\ldrupd.bin"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
launcher.exe
ldrupd.bin
memory/912-599-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-608-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-2-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-3-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-6-0x0000000002B50000-0x0000000002BFD000-memory.dmp
memory/912-5-0x00000000001F0000-0x00000000001FC000-memory.dmp
memory/912-4-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-7-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-20-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-19-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-18-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-17-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-16-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-15-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-14-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-13-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-12-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-11-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-10-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-9-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-8-0x00000000023A0000-0x000000000242B000-memory.dmp
memory/912-21-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-22-0x0000000003130000-0x00000000031BD000-memory.dmp
memory/912-26-0x00000000031C0000-0x00000000031EB000-memory.dmp
memory/912-23-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-27-0x0000000002430000-0x0000000002431000-memory.dmp
memory/912-38-0x0000000003130000-0x00000000031BD000-memory.dmp
memory/912-592-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-605-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-607-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-602-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-601-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-614-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-616-0x0000000002B50000-0x0000000002BFD000-memory.dmp
memory/912-0-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-1-0x0000000140000000-0x0000000142458000-memory.dmp
memory/912-595-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-603-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-600-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-597-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-594-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-604-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-598-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-596-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/912-593-0x0000000005C00000-0x0000000006870000-memory.dmp
memory/1656-626-0x000001DD40AE0000-0x000001DD40B8D000-memory.dmp
memory/4832-1213-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1205-0x00000000001F0000-0x00000000001FC000-memory.dmp
memory/4832-628-0x0000000140000000-0x0000000142458000-memory.dmp
memory/4832-631-0x0000000002440000-0x0000000002441000-memory.dmp
memory/4832-1197-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1198-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1196-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-629-0x0000000140000000-0x0000000142458000-memory.dmp
memory/4832-1195-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1202-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-627-0x0000000140000000-0x0000000142458000-memory.dmp
memory/4832-1208-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-630-0x0000000140000000-0x0000000142458000-memory.dmp
memory/4832-1207-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1203-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1212-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1200-0x0000000140000000-0x0000000142458000-memory.dmp
memory/4832-1209-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1211-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1199-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1201-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1204-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1206-0x00000000034B0000-0x0000000004120000-memory.dmp
memory/4832-1216-0x0000000005000000-0x00000000050AD000-memory.dmp
memory/4832-1220-0x0000000140000000-0x0000000142458000-memory.dmp