b52c393326b2160af5ef4a857181e22b87baaed086fb1c610efc902c166cf446

Analysis

user interaction
yes
max time kernel
30s
max time network
31s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VadeLauncher.exe
Size 741KB
Sample260523-d2e7dscs2l
SHA256 b52c393326b2160af5ef4a857181e22b87baaed086fb1c610efc902c166cf446
MD5 321c9cec2bfb47699479317e7d66c821
SHA1 2174d29beda896a5b8fe4b13ec28a37eacd36964
SHA512 8469d4ac4342146aca244641d521703c908cbf1a9c41b2e562ba862434086863c7830ef37d8b440555f51f3398fd133db7017f8745d5e4c10ea7be133fac1689
SSDEEP 12288:KciZ4qN4ZkKdcLtmUzG8GIJ9EDVaTj/JxX78j/mFSaD3kvfYHB9k:B25kkKdcLt08/9+VaTj/7wE3kvfr
TLSH
T1B4F4CF19D7E405FDE1B7E578CD438912EB76784D07A1E7CF03A499A61F232A08E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3092	loader.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
1	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 3092	3204	VadeLauncher.exe	83
PID 3092 wrote to memory of 1492	3092	loader.exe	84

C:\Users\Admin\AppData\Local\Temp\VadeLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\VadeLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
    "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python.exe" C:\Users\Admin\AppData\Local\Temp\VadeData.py
    3⤵
    PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\loader.exe
Size 972KB
SHA256 3e77d7d458a36c990607ded544d1560edaff2707afdec81ed3105d8f95af2f3d
MD5 e31e691f4c71167bd65f80820c9648a7
SHA1 02f18b9a511a64bb37e9b84d862ff0c5d0edcb77
SHA512 acd8ed8300796f90be09aec0b86986468adbe4a7b9b971334018a2794ff72e8b81929a57e12ffa436226cd0a8f1bfc5b68f6ef34f856d56530c5c1aff286dea6
SSDEEP 12288:q8rZyCKB8NQsLfmW22JjpN5dmTHK/q7+zvFQRu3QFcSHA5NjUO1YIu:q0FKwQsLfz2wjpN5dmCjeRC5NjUO1YIu
TLSH
T1B625498276DA1CEADE932B3C59CF53357738FEB08B6A8B2B0514E2312C136D16D5A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3092-17-0x00007FF6F8E90000-0x00007FF6F8F20000-memory.dmp

Download

memory/3092-19-0x00007FF6F8E90000-0x00007FF6F8F20000-memory.dmp