Analysis
- geolocation tags
cacanadananorth-americatoronto - user interaction
yes - max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
General
- Target Launcher.exe
- Size 66.8MB
- Sample260812-3d4brawgrc
- SHA256 559cb6dac57da660ae3a0f1575cca446eceb8d3dc5978ab960ce9f603c8d1e16
- MD5 fea63b5fa86933145762879e020c048a
- SHA1 895c8df29942f94a424693a4e7baa09271228e6d
- SHA512 c7a97327235330157cab2091d9c99e15eda656babd44eb9bcd82774debc8146ba0d2fccd28816bb62cfef7bdf774fc884d3b8cab3772523d0dab888ddcaf9e71
- SSDEEP 1572864:nf557tMY5PoYdG1SrG3J+lu8ghG0W0RHsNgL2oKcnJKfBmfS:TtpndASa3S3YG70iNS6B
- TLSH T1A0E7231493E404A5E97BDB34C666D333CAB0BC529635C10F0999F2421F73EA29B6F726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Kills process with taskkill 4 IoCs
pid Process 3040 taskkill.exe 5088 taskkill.exe 3820 taskkill.exe 4028 taskkill.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2952 Launcher.exe 2952 Launcher.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2952 Launcher.exe Token: SeDebugPrivilege 3040 taskkill.exe Token: SeDebugPrivilege 5088 taskkill.exe Token: SeDebugPrivilege 3820 taskkill.exe Token: SeDebugPrivilege 4028 taskkill.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2952 wrote to memory of 3040 2952 Launcher.exe 85 PID 2952 wrote to memory of 5088 2952 Launcher.exe 88 PID 2952 wrote to memory of 3820 2952 Launcher.exe 90 PID 2952 wrote to memory of 4028 2952 Launcher.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /T /IM EasyAntiCheat_EOS.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /T /IM SILENTX-OSU.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /T /IM lame.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /T /IM SilentXLauncher.App.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4028
-