f10bc293f4df87908af644d40a30a73a55ca76954e1dacb7c6957e5d79d02592

Analysis

max time kernel
299s
max time network
270s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HairoLauncher.exe
Size 171.8MB
Sample260808-rdg8qsstct
SHA256 f10bc293f4df87908af644d40a30a73a55ca76954e1dacb7c6957e5d79d02592
MD5 d2b0336dc0dd40d13b6edc2583415997
SHA1 133b2e490a656cd6e975b16ff7c6c72ff7a9ab40
SHA512 3209dfde0aaa8e1a5aafb3631ea36ef7dc76a2135eb950abb66b277184063b2b893df01d95c75c6e6863a38a79a7f0de4fe375e5d818d0e4de3ccaf0ca6acc2b
SSDEEP 1572864:fasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:X4fc/M+i6xCL
TLSH
T1C5888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
996	javaw.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 788	468	HairoLauncher.exe	79
PID 468 wrote to memory of 788	468	HairoLauncher.exe	79
PID 468 wrote to memory of 996	468	HairoLauncher.exe	80

C:\Users\Admin\AppData\Local\Temp\HairoLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\HairoLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\HairoLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\HairoLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\HairoLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1676,i,11609086494591449440,6608365940765419826,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1664 /prefetch:2
  2⤵
  PID:788
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\b12e33f29cd8.jar V ira-7dc0b77d::default
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna3206530314225501692.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna3206530314225501692.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download