Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
cb-launcher.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb-launcher.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target cb-launcher.exe
- Size 2.6MB
- Sample260817-fehecatckc
- SHA256 c316e67a2136dcd29f49ddfbf3558286e7b0361813b99da063e73c8127a298b1
- MD5 b1285afd8abaaed71b988436196da574
- SHA1 610acefe855385d7c99aadcf7d2888adca2dd68a
- SHA512 2b6755c4b6e9f8f7c96cbfb797ce29c7eafbafd5861e33406b570349fd9713aca2077707b31cc551515029b57c110ebf1cd13c38dd5d529eb14149a16c95fea5
- SSDEEP 49152:0GxyvJAUMrNAv830y+nR4U4GrddpSVSFKdo/HnFW9v4G:YJMrNb7+v/v4Ro/oz
- TLSH T1F9C58D2763EC00E9E0B6C178CE979A06E7737446037167DF16A086AA5FA77E40E7E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 18 raw.githubusercontent.com 19 raw.githubusercontent.com 21 raw.githubusercontent.com 22 raw.githubusercontent.com 23 raw.githubusercontent.com 2 raw.githubusercontent.com 11 raw.githubusercontent.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\ = "URL:CB Servers Protocol" cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\DefaultIcon cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\shell cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\URL Protocol cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cb-launcher.exe\",0" cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\shell\open\command cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\shell\open cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\cbservers\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cb-launcher.exe\" \"%1\"" cb-launcher.exe