db0339ab033cc3aab0bc70801dfdfb182410c773415b97922d55448a23ac6b29

Resubmissions

23/07/2026, 01:55

260723-cb62ravsdy7

07/07/2026, 23:29

260707-3gsdnafz5z6

Analysis

user interaction
yes
max time kernel
130s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SaftLauncher.exe
Size 4.0MB
Sample260723-cb62ravsdy
SHA256 db0339ab033cc3aab0bc70801dfdfb182410c773415b97922d55448a23ac6b29
MD5 e1c738382c502187ecae685549fb0a4a
SHA1 0048be036b424619337183ad271d9b9d4533d534
SHA512 f05b00a972a90cff2b3916983863d00b134bda07b0db6664eb67d3dd7b6fbcf6dc19d0f185ca5cc9e524a5ef77276842122913fefbd12b97d78c60b13e9df31e
SSDEEP 98304:lLTIuHr8cZMkEUEC3FNtH7l3K34VeimR465l:lLTDHr8cZREUDNtbJKlB/5l
TLSH
T1081623C1F2F501F9E07BD138DA85A11BEAB63465173056EF23E0465A3FA36E01A7B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1160	SaftLauncher.exe

Executes dropped EXE 1 IoCs

pid	Process
1160	SaftLauncher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3488	SaftLauncher.exe
1160	SaftLauncher.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3488	SaftLauncher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3488	SaftLauncher.exe
1160	SaftLauncher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1160	3488	SaftLauncher.exe	89

C:\Users\Admin\AppData\Local\Temp\SaftLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\SaftLauncher.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\SaftLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\SaftLauncher.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SaftLauncher.exe

Path C:\Users\Admin\AppData\Local\Temp\SaftLauncher.exe
Size 4.1MB
SHA256 587ba35e01914c0e52cab5eae768b5942eb5015858dffaf83b8542a46aae7055
MD5 ccb37b1c8f838fee1f5243f00784f754
SHA1 bee9e09b99ec787064151d3b31b78049a5328d27
SHA512 1420bac535fe026f4c712353a06b645640f091b220fe0c6acb695d58b8898a28e40151faa09b06680cab840617ff3403a9eb47fd3ac1cb42ccfd3430254cb677
SSDEEP 98304:KCnFm7jIFsEh2s/ACBSYEw1IHjR7U52Lw6n0JTldC00di/:jQIFNXA8aHjPvcb
TLSH
T1B2162386F2F506FCE07B9138C586A61BEA757859032457DF23E442682FA77E01FBA311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3488-7-0x00007FF6F4520000-0x00007FF6F4925000-memory.dmp

Download