fb3f058428c13fd833cdf927542d93a1a524074a2e6100c89f78ed943a97836e

Analysis

max time kernel
151s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 4.6MB
Sample260626-l2rt7aat4s
SHA256 fb3f058428c13fd833cdf927542d93a1a524074a2e6100c89f78ed943a97836e
MD5 67ba4bbda1503f62bc22c369f58087ea
SHA1 2096de160c0baaedddd32ebf82a56d0e71c0f978
SHA512 1411884bef3666b54e86c5ddb794f8a357d6a98a5748e7487b5fae5e22699e8d09aec50bafaa8a05564c944c8d5f830991f206d16038785934b332a7129d8aee
SSDEEP 98304:ydnxsmQrjDCHgpIQG8BCl2nBstBP75ShGid0g0+:+n77HyIQG8wlSBstBD5ShDl0+
TLSH
T194369E82076AD781E129067649655F2D62E9486ECF86CB03F3C42DF31AF1FCE2B0569D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdMalwareDef32.exe"	Launcher.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
3492	Process not Found
4936	Process not Found
3672	xdwdMalwareDef32.exe
3364	xdwdMalwareDef32.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
3096	Process not Found

Loads dropped DLL 7 IoCs

pid	Process
3404	Launcher.exe
264	Process not Found
6052	xdwdMalwareDef32.exe
3364	xdwdMalwareDef32.exe
264	Process not Found
3492	Process not Found
4936	Process not Found

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	pastebin.com
37	pastebin.com
1	pastebin.com
7	pastebin.com
13	pastebin.com
14	pastebin.com

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	api.ipify.org
1	api.ipify.org
8	api.ipify.org
16	api.ipify.org
17	api.ipify.org
18	api.ipify.org

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\xdwdMalwareDef64.exe	xdwdMalwareDef32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\xdwdMalwareDef64.exe	xdwdMalwareDef32.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwd.dll	Launcher.exe
File opened for modification	C:\Windows\xdwdMalwareDef32.exe	xdwdMalwareDef64.exe
File created	C:\Windows\xdwdMalwareDef32.exe	Launcher.exe
File opened for modification	C:\Windows\xdwdMalwareDef32.exe	Launcher.exe
File created	C:\Windows\xdwd.dll	Launcher.exe
File opened for modification	C:\Windows\xdwd.dll	xdwdMalwareDef32.exe
File opened for modification	C:\Windows\xdwd.dll	xdwdMalwareDef32.exe
File opened for modification	C:\Windows\xdwdMalwareDef32.exe	xdwdMalwareDef32.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3752	sc.exe
4820	sc.exe
4004	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	xdwdMalwareDef32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	xdwdMalwareDef32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	xdwdMalwareDef32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	xdwdMalwareDef32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	xdwdMalwareDef32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	xdwdMalwareDef32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	xdwdMalwareDef32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\InprocServer32\ = "C:\\Windows\\xdwdMalwareDef32.exe"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\InprocServer32\ThreadingModel = "Apartment"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\ = "System Component"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\InprocServer32	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID	Launcher.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3404	Launcher.exe
6052	xdwdMalwareDef32.exe
6052	xdwdMalwareDef32.exe
3364	xdwdMalwareDef32.exe
3364	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe
5496	xdwdMalwareDef64.exe
6052	xdwdMalwareDef32.exe
5496	xdwdMalwareDef64.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	Launcher.exe
Token: SeDebugPrivilege	3364	xdwdMalwareDef32.exe
Token: SeDebugPrivilege	3672	xdwdMalwareDef32.exe
Token: SeDebugPrivilege	6052	xdwdMalwareDef32.exe
Token: SeIncBasePriorityPrivilege	6052	xdwdMalwareDef32.exe
Token: SeIncBasePriorityPrivilege	3364	xdwdMalwareDef32.exe
Token: SeDebugPrivilege	5496	xdwdMalwareDef64.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3404	Launcher.exe
3404	Launcher.exe
6052	xdwdMalwareDef32.exe
6052	xdwdMalwareDef32.exe
3364	xdwdMalwareDef32.exe
3364	xdwdMalwareDef32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4708	3404	Launcher.exe	91
PID 3404 wrote to memory of 4000	3404	Launcher.exe	93
PID 4000 wrote to memory of 4768	4000	CMD.exe	95
PID 3404 wrote to memory of 4004	3404	Launcher.exe	100
PID 3404 wrote to memory of 3752	3404	Launcher.exe	102
PID 3404 wrote to memory of 4820	3404	Launcher.exe	105
PID 3404 wrote to memory of 3672	3404	Launcher.exe	108
PID 6052 wrote to memory of 1996	6052	xdwdMalwareDef32.exe	111
PID 1996 wrote to memory of 4200	1996	CMD.exe	113
PID 3364 wrote to memory of 3592	3364	xdwdMalwareDef32.exe	114
PID 6052 wrote to memory of 5496	6052	xdwdMalwareDef32.exe	116
PID 3592 wrote to memory of 5456	3592	CMD.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name=",/3}gJ%Mg3~PgX" dir=in action=allow program="C:\Windows\xdwdMalwareDef32.exe" enable=yes & exit
  2⤵
  PID:4708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /run /i /tn "ShellHost"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\system32\schtasks.exe
    schtasks /run /i /tn "ShellHost"
    3⤵
    PID:4768
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" query "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4004
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\xdwdMalwareDef32.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3752
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4820
- C:\Windows\xdwdMalwareDef32.exe
  "C:\Windows\xdwdMalwareDef32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3672

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1808

C:\Windows\xdwdMalwareDef32.exe
C:\Windows\xdwdMalwareDef32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\CMD.exe
  "CMD" /c schtasks /run /i /tn "CookieManager"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\System32\schtasks.exe
    schtasks /run /i /tn "CookieManager"
    3⤵
    PID:5456

C:\Windows\xdwdMalwareDef32.exe
C:\Windows\xdwdMalwareDef32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\System32\CMD.exe
  "CMD" /c schtasks /run /i /tn "CookieManager"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\System32\schtasks.exe
    schtasks /run /i /tn "CookieManager"
    3⤵
    PID:4200
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMalwareDef64.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMalwareDef64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5496

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:480

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 158KB
SHA256 a007a19a04d2add20fa2a7714ad1b225ad0d0a555e55b59002804cd15b89bf89
MD5 5513a771c9d9e913060e2f561060da2c
SHA1 cba2eb689e508c482e47c07664f0b0474388dee3
SHA512 84f5006a776a385579584c7755193cc8e6f619d803c28722d47ac200f76f9c4c74f5b960ac2fa6bf3f081f9d9ccaa2310cfd46aeef2c0f06b1e455775a093247
SSDEEP 3072:7Bws30PkkHsWsH+nrzY9A4tf7c/YLC32MdJ:LpQ1sHj6Tx
TLSH
T114F36B57B7A6507BE1678939C9930D05EB72BC424B90AADF03600AF61F277E09E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3404-13-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-9-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-3-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-4-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-5-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-6-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-7-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-10-0x00000292066F0000-0x00000292066F1000-memory.dmp

Download

memory/3404-1-0x0000029204530000-0x0000029204AEC000-memory.dmp

Download

memory/3404-11-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-2-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-12-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-8-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-14-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-15-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-16-0x00000292067B0000-0x00000292067B6000-memory.dmp

Download

memory/3404-18-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-19-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-20-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-21-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download

memory/3404-45-0x000002921F0E0000-0x000002921F10C000-memory.dmp

Download

memory/3404-0-0x00007FFCE16CF000-0x00007FFCE16D0000-memory.dmp

Download

memory/3404-76-0x00007FFCE1540000-0x00007FFCE1EE4000-memory.dmp

Download