402473ced4052af52f141a35490d3bc66fd0c31896ed57b13993583ea8177478

Analysis

max time kernel
0s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RajaWareElite.exe
Size 11.7MB
Sample260529-cd5lpsay81
SHA256 402473ced4052af52f141a35490d3bc66fd0c31896ed57b13993583ea8177478
MD5 070bbf16c009ba598a53e114b8653877
SHA1 481f552577d150807d97a7f2e0e4d6f5810d582f
SHA512 16fdfdadfb405d7c1b03afa58f430522188b905e41c73a727c72890d1525a5023f6aab6793dc8062bb7fa9f552f33af8b29ec3ccb2a486bd83d9584d289277b8
SSDEEP 98304:CiyLWGuTHgswG1w1M8T+ObFcRMPPfdwZgIrNuUPgS7ghickgTMJi4a18huz/BDdc:/gswGS1JXPquaihahuz/BDd/VT
TLSH
T154C60721BB5B99ACD19BC47483474A724A7170CB0B35B9FF449482382FAABF45F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RajaWareElite.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3292	RajaWareElite.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2056	3292	RajaWareElite.exe	89
PID 2056 wrote to memory of 2296	2056	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\RajaWareElite.exe
"C:\Users\Admin\AppData\Local\Temp\RajaWareElite.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RajaWareElite.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.rajaware.elite\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3292.4680.2221265034091723917
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.rajaware.elite\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.rajaware.elite\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaea72b078,0x7ffaea72b084,0x7ffaea72b090
    3⤵
    PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.rajaware.elite\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 10e1878d3b58b4eb13bde02a308a4add56dc2aa745888479f215d100e7437b7f
MD5 81def78501a865233a8557117f65ada6
SHA1 2e23dc6f03eddd80af82cc0d59bfd3ace001f26c
SHA512 a573d39cbade34611a6704ddcde7ab69b7b4f749fdb730ba621d044604c0964c19c94e3b4f7cab5b9ab2526f9e599197498712b747baf51c47b277aeca16acbf
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.rajaware.elite\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512