Analysis
- user interaction
yes - max time kernel
18s - max time network
9s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
17/08/2026, 01:25
General
- Target WolfGamesLauncher.exe
- Size 18.5MB
- Sample260817-btevjs1bqa
- SHA256 76e71c9b6b1b5bf65a825eecf5bd119c77b406384b14a4e6c7d087059afd6422
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WolfGamesLauncher.exe"C:\Users\Admin\AppData\Local\Temp\WolfGamesLauncher.exe"1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
wolfgames_bg.mp4
memory/2520-12-0x000000001E3A0000-0x000000001E3B0000-memory.dmp
memory/2520-13-0x000000001E3A0000-0x000000001E3B0000-memory.dmp
memory/2520-14-0x000000001E3A0000-0x000000001E3B0000-memory.dmp
memory/2520-15-0x0000000021440000-0x0000000021478000-memory.dmp
memory/2520-16-0x000000001E390000-0x000000001E39E000-memory.dmp
memory/2520-0-0x00000000008F0000-0x0000000001B7E000-memory.dmp
memory/2520-1-0x000000001E3A0000-0x000000001E3B0000-memory.dmp
memory/2520-40-0x000000001E3A0000-0x000000001E3B0000-memory.dmp
memory/2520-41-0x000000001E3A0000-0x000000001E3B0000-memory.dmp
memory/2520-42-0x000000001E3A0000-0x000000001E3B0000-memory.dmp