Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 18:11
General
- Target ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
- Size 18.0MB
- Sample260811-ws2cdayapc
- SHA256 be14927734e93145a58b75e8f08f0b7859b564f391eaf2a38c8009df35a5b74a
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 15 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe"C:\Users\Admin\AppData\Local\Temp\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{D87ED4C5-373C-46B0-A82F-B6C710920EB1}\.cr\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe"C:\Windows\Temp\{D87ED4C5-373C-46B0-A82F-B6C710920EB1}\.cr\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe" -burn.filehandle.attached=772 -burn.filehandle.self=6282⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BootstrapperCore.config
BootstrapperCore.dll
EPS.Devices.Tracing.Library.dll
EPS.Devices.Wix.WpfBootstrapper.dll
InfragisticsWPF4.DataPresenter.v11.2.dll
InfragisticsWPF4.Editors.v11.2.dll
InfragisticsWPF4.v11.2.dll
JHAWPFCtls_2012.9.0.dll
mbahost.dll
ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
memory/4452-60-0x00000000735B0000-0x0000000073D6C000-memory.dmp
memory/4452-55-0x00000000037D0000-0x00000000037E8000-memory.dmp
memory/4452-61-0x00000000735B0000-0x0000000073D6C000-memory.dmp
memory/4452-72-0x00000000077F0000-0x0000000007882000-memory.dmp
memory/4452-73-0x00000000735B0000-0x0000000073D6C000-memory.dmp
memory/4452-74-0x00000000735B0000-0x0000000073D6C000-memory.dmp
memory/4452-75-0x00000000735B0000-0x0000000073D6C000-memory.dmp
memory/4452-65-0x0000000006A80000-0x0000000006AD0000-memory.dmp
memory/4452-79-0x000000000C1D0000-0x000000000C28C000-memory.dmp
memory/4452-57-0x00000000735B0000-0x0000000073D6C000-memory.dmp
memory/4452-83-0x000000000C290000-0x000000000C342000-memory.dmp
memory/4452-69-0x00000000045D0000-0x00000000045DA000-memory.dmp
memory/4452-89-0x000000000C4E0000-0x000000000C670000-memory.dmp
memory/4452-50-0x00000000735C2000-0x00000000735C3000-memory.dmp
memory/4452-95-0x000000000C940000-0x000000000CC06000-memory.dmp
memory/4452-98-0x000000000C8A0000-0x000000000C8DE000-memory.dmp
memory/4452-99-0x000000000C4D0000-0x000000000C4DE000-memory.dmp
memory/4452-100-0x000000000C890000-0x000000000C898000-memory.dmp
memory/4452-101-0x000000000C8E0000-0x000000000C8E8000-memory.dmp
memory/4452-102-0x00000000735C2000-0x00000000735C3000-memory.dmp
memory/4452-103-0x00000000735B0000-0x0000000073D6C000-memory.dmp