68582e0cd340f3a9a47778d6ae579eebb6b3db9ba00b3924714f5beed18358d7

Analysis

max time kernel
150s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hytale-f2p-launcher_2.4.8.exe
Size 93.2MB
Sample260722-2bhrlach75
SHA256 68582e0cd340f3a9a47778d6ae579eebb6b3db9ba00b3924714f5beed18358d7
MD5 4a9af0897c8cef862dde3510fac666ac
SHA1 b77eba2aac6ae7aa2cde1195d536af2b4c96a949
SHA512 6fccb784485e8157cca1254c55dc2cad8948f4eca1f4031b754e3d99e670d5701e4fda83119f29d295e10e2647bd59bf09e68009a97a96581ed69e9c417a2b57
SSDEEP 1572864:FaqNJTZ6pshYgFFWxyA4CYfgTbc6cDbOPEVhBL7CXVK6PdlH426OcdhlVDYcD+Mg:FRX9HYOFWMbgTQ12ETBXkNdlFah7bE
TLSH
T11328335D96202A06CB1BC3B56E609EE5EC777DAFDD306C176188FA383E418A0974C973
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1260	Hytale F2P Launcher.exe
5252	Hytale F2P Launcher.exe
5280	Hytale F2P Launcher.exe
2708	Hytale F2P Launcher.exe
5164	Hytale F2P Launcher.exe

Loads dropped DLL 20 IoCs

pid	Process
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
5252	Hytale F2P Launcher.exe
5252	Hytale F2P Launcher.exe
5252	Hytale F2P Launcher.exe
5252	Hytale F2P Launcher.exe
5252	Hytale F2P Launcher.exe
5252	Hytale F2P Launcher.exe
2708	Hytale F2P Launcher.exe
5164	Hytale F2P Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1132	powershell.exe
5504	powershell.exe
5424	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4492	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hytale-f2p-launcher_2.4.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4492	powershell.exe
4492	powershell.exe
1132	powershell.exe
1132	powershell.exe
492	hytale-f2p-launcher_2.4.8.exe
492	hytale-f2p-launcher_2.4.8.exe
5424	powershell.exe
5424	powershell.exe
5504	powershell.exe
5504	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeIncreaseQuotaPrivilege	5424	powershell.exe
Token: SeSecurityPrivilege	5424	powershell.exe
Token: SeTakeOwnershipPrivilege	5424	powershell.exe
Token: SeLoadDriverPrivilege	5424	powershell.exe
Token: SeSystemProfilePrivilege	5424	powershell.exe
Token: SeSystemtimePrivilege	5424	powershell.exe
Token: SeProfSingleProcessPrivilege	5424	powershell.exe
Token: SeIncBasePriorityPrivilege	5424	powershell.exe
Token: SeCreatePagefilePrivilege	5424	powershell.exe
Token: SeBackupPrivilege	5424	powershell.exe
Token: SeRestorePrivilege	5424	powershell.exe
Token: SeShutdownPrivilege	5424	powershell.exe
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeSystemEnvironmentPrivilege	5424	powershell.exe
Token: SeRemoteShutdownPrivilege	5424	powershell.exe
Token: SeUndockPrivilege	5424	powershell.exe
Token: SeManageVolumePrivilege	5424	powershell.exe
Token: 33	5424	powershell.exe
Token: 34	5424	powershell.exe
Token: 35	5424	powershell.exe
Token: 36	5424	powershell.exe
Token: SeSecurityPrivilege	492	hytale-f2p-launcher_2.4.8.exe
Token: SeDebugPrivilege	5504	powershell.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeIncreaseQuotaPrivilege	5504	powershell.exe
Token: SeSecurityPrivilege	5504	powershell.exe
Token: SeTakeOwnershipPrivilege	5504	powershell.exe
Token: SeLoadDriverPrivilege	5504	powershell.exe
Token: SeSystemProfilePrivilege	5504	powershell.exe
Token: SeSystemtimePrivilege	5504	powershell.exe
Token: SeProfSingleProcessPrivilege	5504	powershell.exe
Token: SeIncBasePriorityPrivilege	5504	powershell.exe
Token: SeCreatePagefilePrivilege	5504	powershell.exe
Token: SeBackupPrivilege	5504	powershell.exe
Token: SeRestorePrivilege	5504	powershell.exe
Token: SeShutdownPrivilege	5504	powershell.exe
Token: SeDebugPrivilege	5504	powershell.exe
Token: SeSystemEnvironmentPrivilege	5504	powershell.exe
Token: SeRemoteShutdownPrivilege	5504	powershell.exe
Token: SeUndockPrivilege	5504	powershell.exe
Token: SeManageVolumePrivilege	5504	powershell.exe
Token: 33	5504	powershell.exe
Token: 34	5504	powershell.exe
Token: 35	5504	powershell.exe
Token: 36	5504	powershell.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	1260	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	1260	Hytale F2P Launcher.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1260	Hytale F2P Launcher.exe
1260	Hytale F2P Launcher.exe
1260	Hytale F2P Launcher.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 4492	492	hytale-f2p-launcher_2.4.8.exe	79
PID 492 wrote to memory of 1132	492	hytale-f2p-launcher_2.4.8.exe	81
PID 492 wrote to memory of 5424	492	hytale-f2p-launcher_2.4.8.exe	83
PID 1260 wrote to memory of 5504	1260	Hytale F2P Launcher.exe	89
PID 1260 wrote to memory of 5252	1260	Hytale F2P Launcher.exe	88
PID 1260 wrote to memory of 5252	1260	Hytale F2P Launcher.exe	88
PID 1260 wrote to memory of 5280	1260	Hytale F2P Launcher.exe	91
PID 1260 wrote to memory of 2708	1260	Hytale F2P Launcher.exe	92
PID 1260 wrote to memory of 2708	1260	Hytale F2P Launcher.exe	92
PID 1260 wrote to memory of 5164	1260	Hytale F2P Launcher.exe	93
PID 1260 wrote to memory of 5164	1260	Hytale F2P Launcher.exe	93

C:\Users\Admin\AppData\Local\Temp\hytale-f2p-launcher_2.4.8.exe
"C:\Users\Admin\AppData\Local\Temp\hytale-f2p-launcher_2.4.8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5424

C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1668,i,16625508157896270451,3510774215799897768,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1664 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | Select-Object Name, AdapterRAM | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5504
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --field-trial-handle=1668,i,16625508157896270451,3510774215799897768,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784759071581207 --launch-time-ticks=553457743 --field-trial-handle=1668,i,16625508157896270451,3510774215799897768,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2588 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2708
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1784759071581207 --launch-time-ticks=555990242 --field-trial-handle=1668,i,16625508157896270451,3510774215799897768,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\AppData\Local\HytaleF2P\config.json
Size 424B
SHA256 81746cec773cf0718017aee0fbddc24e73228d9af378c51f86d2e1ed75522429
MD5 977122cca393e5a29ec1765e2b54776b
SHA1 ad6d0839a736dac62f9841e32b126288357fa865
SHA512 c377b210218e9c41df01366a7150a99556f76699ef8fd6626860dabea0233fe4b41a36ad637e2b6efa4d6706c96722bd91d5fae1259e5f8ac406de1dc99874e9
TLSH
T169E09230E8BDAC630584231988B915939B105D574A407E68374D090C4F0AC1F04F674A
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp

Path C:\Users\Admin\AppData\Local\HytaleF2P\config.json.tmp
Size 450B
SHA256 eb7020b5cfcfbe1e57e36f9ba45ff5ade0a9e187acec4df502900b57f5f15136
MD5 8c7271d4f82cb31a3d98cc6b5aab96aa
SHA1 a2790c8fbfb4245ef7e3f1a2fc0d0964026efed8
SHA512 5df5f95d74d44587556bb58f1f2de300aad786d80bb69ad2de9f9daa4fac92b2ce545b677bd5fd01a340e0234a1850f7a48f8266acc42a9616c6f926f2b225c6
TLSH
T194F06D20E879AC731584232D88B955939B205D574A417E68374D090C4F1AC1F15FA74A
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp

Path C:\Users\Admin\AppData\Local\HytaleF2P\config.json.tmp
Size 502B
SHA256 94f71eeb588ad38d404f1614bebf3d492eab64327067f32d0d7db004d1771b0a
MD5 77fa17f3c7e06ab87291cb879b29c4a4
SHA1 0f35e167583f53d3428e9c3a0e81d10a552aea06
SHA512 ba1b7ecb1477eeec70ef85918dc3030bf96cfb7d4b48b77381e3b1fe2dd4335b1cbe91099534859dca740e69284fe3eb0354b1fc259b14907a4bc226df5a8ff2
TLSH
T11EF0A021E8BDACA305D412198CBE15A79B616C570A457D783B8D0A0C4F1ED2F28FBB99
MD5 SHA1 SHA512 TLSH

Submit Download