64b31dcaf2a2c3d9ac204d641cb1a877b16bee00e84fea8f528874505686488f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lineage1RebornLauncher.exe
Size 312KB
Sample260601-n2p2pscw5k
SHA256 64b31dcaf2a2c3d9ac204d641cb1a877b16bee00e84fea8f528874505686488f
MD5 990bfa01c3f03496a65c56d61e8110ab
SHA1 461c1f7d81059ca853ba64587d23f904cdf757b8
SHA512 db792fa66842eb1191bd7e80abd9c9c7dbd0afafd4dded86df66a0338e445ef9cef8ea0d84d4a66475081e286ed36845b9bf9273b8135c53b1c53be33d2b2ace
SSDEEP 6144:ivgvkNFNaxmVEpJnrkVApC7cAt0xCIikrkVApCd:ivggNaxm+oA3DHoA6
TLSH
T134646C02A6E8827AF1FB977899711451EB72B8178B31E7CF1B4049BA1E637D09D34723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3004	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	3828	Lineage1RebornLauncher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3004	3828	Lineage1RebornLauncher.exe	83

C:\Users\Admin\AppData\Local\Temp\Lineage1RebornLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\Lineage1RebornLauncher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -STA -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\Lineage1RebornUpdater\select-client-root.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

select-client-root.ps1

Path C:\Users\Admin\AppData\Local\Temp\Lineage1RebornUpdater\select-client-root.ps1
Size 593B
SHA256 73d262400fba08aeca835b3ccbc9179a7a15e9872967a9c76e236dda4559aed6
MD5 21de6fa1f71acb7487c4917552cbc4cc
SHA1 3ee1a8ed84c27dbfd40b15bd76dc1e078bf271dc
SHA512 57ed4f305c1861345baa7ac44527447948df72dbf98bc51ca881687b1f651696ee69af468fc362ed5586b1d2eb5c6c593eb0da0e714e2e8b8fc84a6097677bcc
TLSH
T144F0E1F09DDFD02008C272410847DEE1CC2863FED069B980BADD655CEC956BDBAB5242
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tcvk4uv0.bvw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcvk4uv0.bvw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3004-10-0x0000023E90EDA000-0x0000023E90EDB000-memory.dmp

Download

memory/3004-11-0x0000023E91400000-0x0000023E91422000-memory.dmp

Download

memory/3004-18-0x0000023E90710000-0x0000023E911D2000-memory.dmp

Download

memory/3004-20-0x0000023E90710000-0x0000023E911D2000-memory.dmp

Download

memory/3004-21-0x0000023E90710000-0x0000023E911D2000-memory.dmp

Download

memory/3004-24-0x0000023E90710000-0x0000023E911D2000-memory.dmp

Download