Overview

overview

7

Static

static

3

Zerion Lau....1.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

3

Zerion Launcher.exe

windows11-21h2-x64

1

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...er.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    600s
  • max time network
    385s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/07/2026, 22:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zerion Launcher.exe
  • Size 172.5MB
  • Sample260722-2ytglsweqa
  • SHA256 2fa0ef508d3a57d996bbe0c547af2946ab241aa253650a5664aa6be7bff67b8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Zerion Launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1724,i,2879846396156998844,8280862667141141709,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      2⤵
        PID:4100
      • C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Zerion Launcher" --field-trial-handle=2088,i,2879846396156998844,8280862667141141709,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        2⤵
          PID:2384
        • C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Zerion Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2496,i,2879846396156998844,8280862667141141709,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:1
          2⤵
            PID:2952
          • C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Zerion Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Zerion Launcher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3324,i,2879846396156998844,8280862667141141709,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:10
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4552

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              default.dic
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
              • Size 2B
              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
              • MD5 SHA1 SHA512
              Submit Download

              data_0
              • Path C:\Users\Admin\AppData\Roaming\Zerion Launcher\GPUCache\data_0
              • Size 8KB
              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_1
              • Path C:\Users\Admin\AppData\Roaming\Zerion Launcher\GPUCache\data_1
              • Size 264KB
              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_2
              • Path C:\Users\Admin\AppData\Roaming\Zerion Launcher\GPUCache\data_2
              • Size 8KB
              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_3
              • Path C:\Users\Admin\AppData\Roaming\Zerion Launcher\GPUCache\data_3
              • Size 8KB
              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Network Persistent State
              • Path C:\Users\Admin\AppData\Roaming\Zerion Launcher\Network\Network Persistent State
              • Size 300B
              • SHA256 63be3b3c937e0befcfcde9477f4e36e070732147c10d4dfbce93f5592c17c4ad
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Network Persistent State~RFe59962b.TMP
              • Path C:\Users\Admin\AppData\Roaming\Zerion Launcher\Network\Network Persistent State~RFe59962b.TMP
              • Size 59B
              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/2952-55-0x00007FFCE7BF0000-0x00007FFCE7BF1000-memory.dmp
              Download

              memory/2952-54-0x00007FFCE7B20000-0x00007FFCE7B21000-memory.dmp
              Download

              memory/2952-100-0x00000277EDCF0000-0x00000277EDD21000-memory.dmp
              Download

              memory/4552-124-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-126-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-125-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-137-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-136-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-135-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-134-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-133-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-132-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download

              memory/4552-131-0x000001D1C76E0000-0x000001D1C76E1000-memory.dmp
              Download