e85f7e2be075d4e1a4e3f3ee24ad261283be786e7bb06a87311364b531906fb2

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
privateAssetDownloader.exe
Size 179.9MB
Sample260603-2bt5maez21
SHA256 e85f7e2be075d4e1a4e3f3ee24ad261283be786e7bb06a87311364b531906fb2
MD5 70caffcb55d06dc8e2a786fbef7cfec3
SHA1 755efb38d95f381df6a0aefd91bb055b5b811717
SHA512 6f2022a8cbbfbf75fec64b8cf9381ec9d8910f622ca364485c8186c11a40a472c67612ac37c9bd6629548294951e46374f077b4263d03f739fee92accb80af77
SSDEEP 1572864:+RQNRtUqjUXOf2Wbi5xWLY2EYGGbPHaG6iwE7xeeSVJdIgpX+7Rc58VdiHxFxEL9:XB2vNhqn9
TLSH
T184988C03F39A50E9E05DD1B58B479633EAB1B8854328A2DF275407912F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	privateAssetDownloader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	privateAssetDownloader.exe
2064	privateAssetDownloader.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe
Token: SeShutdownPrivilege	4508	privateAssetDownloader.exe
Token: SeCreatePagefilePrivilege	4508	privateAssetDownloader.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 872	4508	privateAssetDownloader.exe	80
PID 4508 wrote to memory of 872	4508	privateAssetDownloader.exe	80
PID 4508 wrote to memory of 2440	4508	privateAssetDownloader.exe	81
PID 4508 wrote to memory of 3200	4508	privateAssetDownloader.exe	82
PID 4508 wrote to memory of 3200	4508	privateAssetDownloader.exe	82
PID 4508 wrote to memory of 2064	4508	privateAssetDownloader.exe	83

C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
"C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1744,i,12155052592400430184,9358028996179725695,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:872
- C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --field-trial-handle=2200,i,12155052592400430184,9358028996179725695,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  PID:2440
- C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2452,i,12155052592400430184,9358028996179725695,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:1
  2⤵
  PID:3200
- C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe
  "C:\Users\Admin\AppData\Local\Temp\privateAssetDownloader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\privateassetdownloader" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2560,i,12155052592400430184,9358028996179725695,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2064-73-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-67-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-68-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-69-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-76-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-79-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-78-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-77-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-75-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/2064-74-0x0000028D03D50000-0x0000028D03D51000-memory.dmp

Download

memory/3200-53-0x00007FFCE1730000-0x00007FFCE1731000-memory.dmp

Download

memory/3200-54-0x00007FFCE1740000-0x00007FFCE1741000-memory.dmp

Download