Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 15:37
General
- Target launcher.exe
- Size 26.9MB
- Sample260415-s2vpeaev9w
- SHA256 62940036dbd9a7f5865400e57edad886fa8d12978d70c5c979e4e79311dc54c6
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\ldrupd.bin"C:\Users\Admin\AppData\Local\ldrupd.bin"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
launcher.exe
ldrupd.bin
memory/1812-1205-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-629-0x0000000140000000-0x0000000142458000-memory.dmp
memory/1812-1215-0x00000000004A0000-0x00000000004AC000-memory.dmp
memory/1812-1212-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1211-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1209-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1197-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1200-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1202-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1207-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1208-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1206-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1216-0x00000000028A0000-0x00000000028B2000-memory.dmp
memory/1812-1214-0x0000000000780000-0x0000000000AF8000-memory.dmp
memory/1812-628-0x0000000140000000-0x0000000142458000-memory.dmp
memory/1812-1201-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1199-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1198-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1203-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-1196-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-632-0x0000000002830000-0x0000000002831000-memory.dmp
memory/1812-630-0x0000000140000000-0x0000000142458000-memory.dmp
memory/1812-1204-0x0000000003850000-0x00000000044C0000-memory.dmp
memory/1812-631-0x0000000140000000-0x0000000142458000-memory.dmp
memory/1812-1234-0x0000000140000000-0x0000000142458000-memory.dmp
memory/1996-627-0x000001DB14EF0000-0x000001DB15268000-memory.dmp
memory/5700-19-0x0000000000730000-0x0000000000AA8000-memory.dmp
memory/5700-22-0x0000000140000000-0x0000000142458000-memory.dmp
memory/5700-608-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-605-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-601-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-600-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-603-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-598-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-597-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-596-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-593-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-599-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-594-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-595-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-604-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-616-0x0000000000730000-0x0000000000AA8000-memory.dmp
memory/5700-614-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-615-0x0000000140000000-0x0000000142458000-memory.dmp
memory/5700-602-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-37-0x0000000003580000-0x000000000360D000-memory.dmp
memory/5700-28-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/5700-27-0x0000000003580000-0x000000000360D000-memory.dmp
memory/5700-23-0x0000000140000000-0x0000000142458000-memory.dmp
memory/5700-606-0x0000000005EE0000-0x0000000006B50000-memory.dmp
memory/5700-18-0x0000000140000000-0x0000000142458000-memory.dmp
memory/5700-20-0x0000000002800000-0x000000000280C000-memory.dmp
memory/5700-21-0x0000000002B20000-0x0000000002B32000-memory.dmp
memory/5700-0-0x0000000140000000-0x0000000142458000-memory.dmp
memory/5700-5-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-6-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-7-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-8-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-9-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-10-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-11-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-12-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-13-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-14-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-17-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-15-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-16-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-4-0x0000000002B70000-0x0000000002BFB000-memory.dmp
memory/5700-3-0x0000000140000000-0x0000000142458000-memory.dmp
memory/5700-2-0x0000000140000000-0x0000000142458000-memory.dmp
memory/5700-1-0x0000000140000000-0x0000000142458000-memory.dmp