Overview

overview

7

Static

static

3

Ion Cannon.exe

windows10-2004-x64

7

Ion Cannon.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

Ion Cannon.exe

windows10-2004-x64

7

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-ltsc_2024-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    82s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 16:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ion Cannon.exe
  • Size 180.0MB
  • Sample260804-t47mesam5t
  • SHA256 b98b058821a765e618d5fa6025a234115e79afc80a4cacca606fc0a13ed3a063
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe
    "C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe
      "C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ion Cannon" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1736,i,4990740519507822057,10759313016740218030,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
      2⤵
        PID:5108
      • C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe
        "C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ion Cannon" --field-trial-handle=2168,i,4990740519507822057,10759313016740218030,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:3
        2⤵
          PID:3832
        • C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe
          "C:\Users\Admin\AppData\Local\Temp\Ion Cannon.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ion Cannon" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2396,i,4990740519507822057,10759313016740218030,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:640

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            data_0
            • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Roaming\Ion Cannon\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            default.dic
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            memory/640-15-0x00007FFBCCCB0000-0x00007FFBCCCB1000-memory.dmp
            Download

            memory/640-14-0x00007FFBCBB20000-0x00007FFBCBB21000-memory.dmp
            Download