ec7fe781ca6171f5e04106200b62a66781b95e0624d5f7e9ad9d7ad20023a323

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader (2).exe
Size 316KB
Sample260503-ej5vrsez8q
SHA256 ec7fe781ca6171f5e04106200b62a66781b95e0624d5f7e9ad9d7ad20023a323
MD5 e069bb6f3e0d2a59519f452d4f3e486c
SHA1 2134e63f6439196fdf6fe9ff3138f676e1ae0728
SHA512 67f36dfd56ec9831bd35a343c936b875918b39157462c9907742aced9dc9c22911311006d532639b7f70fd23f7f02ee53fb6f32cd554b87b2773067b8fa24ed1
SSDEEP 6144:jACbCZOQeX52lq3xeqCnQ63/NSTIatcXifQDZ8gAPbGT6/u2A4WaMHZg:jACbCMJBM1/NSTIWcROgAPbfpA4AZ
TLSH
T1F0642282C695AA8CC8A2C3B217634DB69D7B360DDB3844C79B56732DBF32BD85835D01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2876	Launcher.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2876	5064	loader (2).exe	79

C:\Users\Admin\AppData\Local\Temp\loader (2).exe
"C:\Users\Admin\AppData\Local\Temp\loader (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\8F55FD7B\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\8F55FD7B\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\8F55FD7B\Launcher.exe
Size 1.1MB
SHA256 cda7b0197b405e06d20e8316b6ec4b79c9b226319533da9db0a52b4772754173
MD5 f60486a4de28d268e0ad11435d2fe0a4
SHA1 47cca764c64af52383ed82a12786c5e2142335e7
SHA512 82a13647d21824c00263f750657791b237b0b97ed0f533a4c0bf08d00fd93e14d0737125c09f4843c4cadb296d6fdcb7cf6ed23caa8cf5a9566720f859000796
SSDEEP 12288:gZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwG0LvPqItNquB:gcb4M06WpoPrwjvP3f5
TLSH
T16E357C83EBA3C5D8C156C8B5534BF137F9627C8E4A157196ABC41E633E67B64E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download