Overview

overview

8

Static

static

3

cb-launcher.exe

windows10-2004-x64

8

cb-launcher.exe

windows11-21h2-x64

7

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 23:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cb-launcher.exe
  • Size 2.0MB
  • Sample260528-3absbses3t
  • SHA256 566c565475f08b11035ab8f56358604528ae70dfa07007bb7f1ce75c85139678
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --enable-experimental-web-platform-features --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --mojo-platform-channel-handle=2680 --field-trial-handle=2688,i,7536838028995222306,6045724155475809302,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:8
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2496
    • C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --enable-experimental-web-platform-features --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --mojo-platform-channel-handle=2456 --field-trial-handle=2688,i,7536838028995222306,6045724155475809302,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:8
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2508
    • C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --first-renderer-process --no-sandbox --enable-experimental-web-platform-features --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=2688,i,7536838028995222306,6045724155475809302,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:1
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2872
    • C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --no-sandbox --enable-experimental-web-platform-features --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=2688,i,7536838028995222306,6045724155475809302,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:1
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4204

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_100_percent.pak
        • Size 607KB
        • SHA256 80139849d4cf4a9dc8ad429be071229bd7538c41f5af5aed498fd981873bd4cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_200_percent.pak
        • Size 915KB
        • SHA256 f2a2c9dd0ec8baf6820b445a1485787c6651d3f0c8d0ec8f58a808b836fa04d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_elf.dll
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_elf.dll
        • Size 1.4MB
        • SHA256 08ab23efb637be966b98a446e7bade2c321c40d276d1bc9b7bf2c2e372773fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 e4bc3420a28069bd13dc3be725d46676a7c0e99de221026e8c43cd6f7ed45c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\icudtl.dat
        • Size 10.1MB
        • SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\libEGL.dll
        • Size 464KB
        • SHA256 f7d7ac7f1728e2b9005c018dd3b02e7abbb6e72cc5e6487170f4789370d0d73d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\libGLESv2.dll
        • Size 7.0MB
        • SHA256 25c093a77b4a1ea7ed6281b0fea3ff78b65b92943dd428b7b03ca30ba3d18b9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales\en-US.pak
        • Size 384KB
        • SHA256 18b68d00be426a4f7acd4efc1e45ae296720ade13ca66d3cf768e48d814b6a25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\resources.pak
        • Size 7.4MB
        • SHA256 6f9dafb5d3f16b89d13c01bcd52695d0671a66f6719a6bc54a878106903516c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\v8_context_snapshot.bin
        • Size 661KB
        • SHA256 eb3bb6497db6ed980a1702ef2db9df891ea6327a6498e670d038b41f69c3ff10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\vulkan-1.dll
        • Size 902KB
        • SHA256 ae91c4e7548eaf48b1a65c43f518e2c1989b4740efe82726b56b6be31cbfd1c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        the-real-index
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Code Cache\js\index-dir\the-real-index
        • Size 48B
        • SHA256 aa3321059370bd50db03ffd5f9f56f2988b1853150587ca9593430cb5f4d8eb9
        • MD5 SHA1 SHA512
        Submit Download

        the-real-index
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Code Cache\js\index-dir\the-real-index
        • Size 336B
        • SHA256 a3f7b3830d5a18e55a1e7d8149890c314615fbc34206de4282319864e504a7b3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        LocalPrefs.json
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\LocalPrefs.json
        • Size 681B
        • SHA256 703475759570c60cff92bf803647c05c2607c4f061c13dd14280582648c8e781
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LocalPrefs.json~RFe599754.TMP
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\LocalPrefs.json~RFe599754.TMP
        • Size 508B
        • SHA256 7d3bee4a1e53de7dfa950f17f188b91aa51d570db0a24951157511cff5836c49
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Network\Network Persistent State
        • Size 300B
        • SHA256 3968b3428d24555a34d4985c732087993464f6f6694ffe6446f55406c4dacad3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State~RFe59af12.TMP
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Network\Network Persistent State~RFe59af12.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MANIFEST-000001
        • Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        properties.json
        • Path C:\Users\Admin\AppData\Local\cbservers\user\properties.json
        • Size 43B
        • SHA256 8e6b98f7f97d17ee84e73dbc4798ee82ad2c008ece6c1ed683940b5a70811897
        • MD5 SHA1 SHA512
        Submit Download