Analysis
- user interaction
yes - max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
06/05/2026, 12:52
Behavioral task
behavioral1
Sample
obsidian-launcher.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
obsidian-launcher.exe
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target obsidian-launcher.exe
- Size 10.1MB
- Sample260506-p32mkabs8x
- SHA256 cd61c98731f0abac75d162fc2c2ef6394684aa7115049e3090c4e139e4c070c8
- MD5 6b3943115c4b3ca5615ca6f69b4907c4
- SHA1 d37c098ed0b1376e6e91d22019ee860131e1b495
- SHA512 31bef80b55f5993212897b4173433c288ebd1b8d56b4e207ad01dbb0dd1c6750449f6c6beaea30b7b996cd85174832ecc79daf72036ec4255066afdde69742b5
- SSDEEP 196608:Aek5RO+POp3PQO7tJznoQU5HJyWANvl0dSG+/olAbnZv2RoN:AFn8lQO3jU54WANt0dSG+iAbnZv2oN
- TLSH T1DCB633EA77E0A854C8C9577D8B0DA0081D6F77660EC7F20D420B89EC5547A98FF66A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ obsidian-launcher.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion obsidian-launcher.exe -
resource yara_rule behavioral1/memory/2500-0-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral1/memory/2500-1-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral1/memory/2500-3-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral1/memory/2500-4-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral1/memory/2500-2-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral1/memory/2500-7-0x0000000140000000-0x000000014187B000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA obsidian-launcher.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5616 tasklist.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2500 obsidian-launcher.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5500 wmic.exe - Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\VideoBiosVersion obsidian-launcher.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5616 tasklist.exe Token: SeIncreaseQuotaPrivilege 4964 wmic.exe Token: SeSecurityPrivilege 4964 wmic.exe Token: SeTakeOwnershipPrivilege 4964 wmic.exe Token: SeLoadDriverPrivilege 4964 wmic.exe Token: SeSystemProfilePrivilege 4964 wmic.exe Token: SeSystemtimePrivilege 4964 wmic.exe Token: SeProfSingleProcessPrivilege 4964 wmic.exe Token: SeIncBasePriorityPrivilege 4964 wmic.exe Token: SeCreatePagefilePrivilege 4964 wmic.exe Token: SeBackupPrivilege 4964 wmic.exe Token: SeRestorePrivilege 4964 wmic.exe Token: SeShutdownPrivilege 4964 wmic.exe Token: SeDebugPrivilege 4964 wmic.exe Token: SeSystemEnvironmentPrivilege 4964 wmic.exe Token: SeRemoteShutdownPrivilege 4964 wmic.exe Token: SeUndockPrivilege 4964 wmic.exe Token: SeManageVolumePrivilege 4964 wmic.exe Token: 33 4964 wmic.exe Token: 34 4964 wmic.exe Token: 35 4964 wmic.exe Token: 36 4964 wmic.exe Token: SeIncreaseQuotaPrivilege 4964 wmic.exe Token: SeSecurityPrivilege 4964 wmic.exe Token: SeTakeOwnershipPrivilege 4964 wmic.exe Token: SeLoadDriverPrivilege 4964 wmic.exe Token: SeSystemProfilePrivilege 4964 wmic.exe Token: SeSystemtimePrivilege 4964 wmic.exe Token: SeProfSingleProcessPrivilege 4964 wmic.exe Token: SeIncBasePriorityPrivilege 4964 wmic.exe Token: SeCreatePagefilePrivilege 4964 wmic.exe Token: SeBackupPrivilege 4964 wmic.exe Token: SeRestorePrivilege 4964 wmic.exe Token: SeShutdownPrivilege 4964 wmic.exe Token: SeDebugPrivilege 4964 wmic.exe Token: SeSystemEnvironmentPrivilege 4964 wmic.exe Token: SeRemoteShutdownPrivilege 4964 wmic.exe Token: SeUndockPrivilege 4964 wmic.exe Token: SeManageVolumePrivilege 4964 wmic.exe Token: 33 4964 wmic.exe Token: 34 4964 wmic.exe Token: 35 4964 wmic.exe Token: 36 4964 wmic.exe Token: SeIncreaseQuotaPrivilege 2160 wmic.exe Token: SeSecurityPrivilege 2160 wmic.exe Token: SeTakeOwnershipPrivilege 2160 wmic.exe Token: SeLoadDriverPrivilege 2160 wmic.exe Token: SeSystemProfilePrivilege 2160 wmic.exe Token: SeSystemtimePrivilege 2160 wmic.exe Token: SeProfSingleProcessPrivilege 2160 wmic.exe Token: SeIncBasePriorityPrivilege 2160 wmic.exe Token: SeCreatePagefilePrivilege 2160 wmic.exe Token: SeBackupPrivilege 2160 wmic.exe Token: SeRestorePrivilege 2160 wmic.exe Token: SeShutdownPrivilege 2160 wmic.exe Token: SeDebugPrivilege 2160 wmic.exe Token: SeSystemEnvironmentPrivilege 2160 wmic.exe Token: SeRemoteShutdownPrivilege 2160 wmic.exe Token: SeUndockPrivilege 2160 wmic.exe Token: SeManageVolumePrivilege 2160 wmic.exe Token: 33 2160 wmic.exe Token: 34 2160 wmic.exe Token: 35 2160 wmic.exe Token: 36 2160 wmic.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2500 wrote to memory of 5616 2500 obsidian-launcher.exe 84 PID 2500 wrote to memory of 4964 2500 obsidian-launcher.exe 87 PID 2500 wrote to memory of 2160 2500 obsidian-launcher.exe 89 PID 2500 wrote to memory of 2496 2500 obsidian-launcher.exe 91 PID 2500 wrote to memory of 5500 2500 obsidian-launcher.exe 93 PID 2500 wrote to memory of 5860 2500 obsidian-launcher.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\obsidian-launcher.exe"C:\Users\Admin\AppData\Local\Temp\obsidian-launcher.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\system32\tasklist.exe"tasklist" /FO CSV /NH2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5616
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" cpu get Name,ProcessorId /format:list2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" baseboard get Manufacturer,Product,SerialNumber /format:list2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get Model,SerialNumber,Size /format:list2⤵PID:2496
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,PNPDeviceID /format:list2⤵
- Detects videocard installed
PID:5500
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" memorychip get Capacity,Manufacturer,PartNumber,SerialNumber /format:list2⤵PID:5860
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5112