Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/06/2026, 17:19
Behavioral task
behavioral1
Sample
obsidian-launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
obsidian-launcher.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target obsidian-launcher.exe
- Size 10.1MB
- Sample260621-vv5bdae19x
- SHA256 cd61c98731f0abac75d162fc2c2ef6394684aa7115049e3090c4e139e4c070c8
- MD5 6b3943115c4b3ca5615ca6f69b4907c4
- SHA1 d37c098ed0b1376e6e91d22019ee860131e1b495
- SHA512 31bef80b55f5993212897b4173433c288ebd1b8d56b4e207ad01dbb0dd1c6750449f6c6beaea30b7b996cd85174832ecc79daf72036ec4255066afdde69742b5
- SSDEEP 196608:Aek5RO+POp3PQO7tJznoQU5HJyWANvl0dSG+/olAbnZv2RoN:AFn8lQO3jU54WANt0dSG+iAbnZv2oN
- TLSH T1DCB633EA77E0A854C8C9577D8B0DA0081D6F77660EC7F20D420B89EC5547A98FF66A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ obsidian-launcher.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion obsidian-launcher.exe -
resource yara_rule behavioral2/memory/588-0-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-1-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-3-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-4-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-2-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-5-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-6-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-7-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-8-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-9-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-10-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-11-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-12-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-13-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-14-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-15-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-16-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-17-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-18-0x0000000140000000-0x000000014187B000-memory.dmp themida behavioral2/memory/588-19-0x0000000140000000-0x000000014187B000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA obsidian-launcher.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 588 obsidian-launcher.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2108 wmic.exe - Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct obsidian-launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\VideoBiosVersion obsidian-launcher.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 588 obsidian-launcher.exe 588 obsidian-launcher.exe 5800 wmic.exe 5800 wmic.exe 5800 wmic.exe 5800 wmic.exe 4148 wmic.exe 4148 wmic.exe 4148 wmic.exe 4148 wmic.exe 1372 wmic.exe 1372 wmic.exe 1372 wmic.exe 1372 wmic.exe 2108 wmic.exe 2108 wmic.exe 2108 wmic.exe 2108 wmic.exe 4248 wmic.exe 4248 wmic.exe 4248 wmic.exe 4248 wmic.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe 588 obsidian-launcher.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5800 wmic.exe Token: SeSecurityPrivilege 5800 wmic.exe Token: SeTakeOwnershipPrivilege 5800 wmic.exe Token: SeLoadDriverPrivilege 5800 wmic.exe Token: SeSystemProfilePrivilege 5800 wmic.exe Token: SeSystemtimePrivilege 5800 wmic.exe Token: SeProfSingleProcessPrivilege 5800 wmic.exe Token: SeIncBasePriorityPrivilege 5800 wmic.exe Token: SeCreatePagefilePrivilege 5800 wmic.exe Token: SeBackupPrivilege 5800 wmic.exe Token: SeRestorePrivilege 5800 wmic.exe Token: SeShutdownPrivilege 5800 wmic.exe Token: SeDebugPrivilege 5800 wmic.exe Token: SeSystemEnvironmentPrivilege 5800 wmic.exe Token: SeRemoteShutdownPrivilege 5800 wmic.exe Token: SeUndockPrivilege 5800 wmic.exe Token: SeManageVolumePrivilege 5800 wmic.exe Token: 33 5800 wmic.exe Token: 34 5800 wmic.exe Token: 35 5800 wmic.exe Token: 36 5800 wmic.exe Token: SeIncreaseQuotaPrivilege 5800 wmic.exe Token: SeSecurityPrivilege 5800 wmic.exe Token: SeTakeOwnershipPrivilege 5800 wmic.exe Token: SeLoadDriverPrivilege 5800 wmic.exe Token: SeSystemProfilePrivilege 5800 wmic.exe Token: SeSystemtimePrivilege 5800 wmic.exe Token: SeProfSingleProcessPrivilege 5800 wmic.exe Token: SeIncBasePriorityPrivilege 5800 wmic.exe Token: SeCreatePagefilePrivilege 5800 wmic.exe Token: SeBackupPrivilege 5800 wmic.exe Token: SeRestorePrivilege 5800 wmic.exe Token: SeShutdownPrivilege 5800 wmic.exe Token: SeDebugPrivilege 5800 wmic.exe Token: SeSystemEnvironmentPrivilege 5800 wmic.exe Token: SeRemoteShutdownPrivilege 5800 wmic.exe Token: SeUndockPrivilege 5800 wmic.exe Token: SeManageVolumePrivilege 5800 wmic.exe Token: 33 5800 wmic.exe Token: 34 5800 wmic.exe Token: 35 5800 wmic.exe Token: 36 5800 wmic.exe Token: SeIncreaseQuotaPrivilege 4148 wmic.exe Token: SeSecurityPrivilege 4148 wmic.exe Token: SeTakeOwnershipPrivilege 4148 wmic.exe Token: SeLoadDriverPrivilege 4148 wmic.exe Token: SeSystemProfilePrivilege 4148 wmic.exe Token: SeSystemtimePrivilege 4148 wmic.exe Token: SeProfSingleProcessPrivilege 4148 wmic.exe Token: SeIncBasePriorityPrivilege 4148 wmic.exe Token: SeCreatePagefilePrivilege 4148 wmic.exe Token: SeBackupPrivilege 4148 wmic.exe Token: SeRestorePrivilege 4148 wmic.exe Token: SeShutdownPrivilege 4148 wmic.exe Token: SeDebugPrivilege 4148 wmic.exe Token: SeSystemEnvironmentPrivilege 4148 wmic.exe Token: SeRemoteShutdownPrivilege 4148 wmic.exe Token: SeUndockPrivilege 4148 wmic.exe Token: SeManageVolumePrivilege 4148 wmic.exe Token: 33 4148 wmic.exe Token: 34 4148 wmic.exe Token: 35 4148 wmic.exe Token: 36 4148 wmic.exe Token: SeIncreaseQuotaPrivilege 4148 wmic.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 588 obsidian-launcher.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 588 wrote to memory of 5800 588 obsidian-launcher.exe 88 PID 588 wrote to memory of 4148 588 obsidian-launcher.exe 91 PID 588 wrote to memory of 1372 588 obsidian-launcher.exe 93 PID 588 wrote to memory of 2108 588 obsidian-launcher.exe 95 PID 588 wrote to memory of 4248 588 obsidian-launcher.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\obsidian-launcher.exe"C:\Users\Admin\AppData\Local\Temp\obsidian-launcher.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\System32\Wbem\wmic.exe"wmic" cpu get Name,ProcessorId /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5800
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" baseboard get Manufacturer,Product,SerialNumber /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" diskdrive get Model,SerialNumber,Size /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,PNPDeviceID /format:list2⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:2108
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" memorychip get Capacity,Manufacturer,PartNumber,SerialNumber /format:list2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4248
-