d261702a2b1915005a3a28058af1b058f3b587f5b44a09ce1cc6985f33de8cae

Analysis

user interaction
yes
max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PALFINGER_VR_Setup.exe
Size 10.3MB
Sample260817-vabtbsem6v
SHA256 d261702a2b1915005a3a28058af1b058f3b587f5b44a09ce1cc6985f33de8cae
MD5 a523a08bf001f6a7879db3672f59ebea
SHA1 33f50e330b816cb42dd344a795bf43758891210d
SHA512 8a5ae379f98165aa3dc0febbeba226a8016f537737f51f108721441b0ba0126095904613f26809d0b80a32ad4851a359328c819b1e6aca5422cc667ebc0e6b7d
SSDEEP 196608:dFqfiMbF1Y7G2eBNTwhL2ek6ourHMuhHToAUPNfGU5vXvbjUydkk0ax8lL9kdIb:d5M5q7jLiuJhHTodRGkX0yd0axIqcA
TLSH
T149B63363A2C354B8F967DA344252811382A1FC827F25D5DF12C97EA37D377E4293827A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4900	Launcher.exe

Loads dropped DLL 12 IoCs

pid	Process
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe
552	PALFINGER_VR_Setup.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4428	tasklist.exe
5612	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4900	Launcher.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	tasklist.exe
Token: SeDebugPrivilege	5612	tasklist.exe
Token: SeDebugPrivilege	4900	Launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2844	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 552	5368	PALFINGER_VR_Setup.exe	90
PID 552 wrote to memory of 4428	552	PALFINGER_VR_Setup.exe	91
PID 552 wrote to memory of 5612	552	PALFINGER_VR_Setup.exe	94
PID 552 wrote to memory of 2128	552	PALFINGER_VR_Setup.exe	96
PID 2844 wrote to memory of 4900	2844	explorer.exe	98

C:\Users\Admin\AppData\Local\Temp\PALFINGER_VR_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\PALFINGER_VR_Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\Temp\PALFINGER_VR_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\PALFINGER_VR_Setup.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq palfingervr.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Launcher.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe C:\palfingervr\launcher\Launcher.exe
    3⤵
    PID:2128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\palfingervr\launcher\Launcher.exe
  "C:\palfingervr\launcher\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\Launcher.exe
Size 1.6MB
SHA256 4136e2288a0da882559ad0013d686ba7144acfcd3cb81c7fc474706b2ae0f122
MD5 bbfec24136c37acb862bbe3f832cee50
SHA1 c0ac4e8b8f9de87d2fcd8b083accee6152612312
SHA512 15725cd94ec435664c4ee039e24d170f7ed5deee6dc83753e591cfd80df8d0d92d445f68c00529f7ee93f270f4257e090615e3a37735bcd0c490e4097dbad3e4
SSDEEP 24576:vp0TyQGahrKgacnvEIqoG116oPTFIJpKCo3bG52t1IunMKlosg:sprZnvsou16Eqora6IunMPsg
TLSH
T1EF75F103A2AB517BD16AC63485929423AB71FC96BF72D18F16403DA72E77B807D2433D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsettings.bin

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\appsettings.bin
Size 2KB
SHA256 22855fa8414a0c94f22ab855e5075397d9a4ad11161e8491281a3aadab3110c1
MD5 7559b8b5f942306eae14b6b5ab45262d
SHA1 e81b2e488874d26555c316216f60568fb2f77234
SHA512 ebb945ea78b0209bfc9d62eef5ad6979f23c50e7d0107707ab61be1e9f0d26b7efd0018eaa8bbb276eba5a486558a2a63cac6776914d145a03c4453877b206bb
TLSH
T120410A6F31D7F0B02056E25E5A04DDE93A5B6447B5F899987AC0AC0E7A0E1404D1A675
MD5 SHA1 SHA512 TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\base_library.zip
Size 1.3MB
SHA256 e0de92df49dc2bd59fabc7d175410da9f6e9f1c6a451b25d9fd083f4535d2a17
MD5 999de5421280924fd382638f04a1c330
SHA1 6da05c7f86fd5a7b27c766a4e4cfe230de625c8a
SHA512 406a935f332245e6f28593d4c8851667887bf1bd0abd76f282444f4a2944ba094f92b75f10c5908a0e3953b8582da2fa80d1e800c13c5779de351a9a34294715
SSDEEP 12288:ap5ow9Wd8lJGUm8rmn9inVTVihlyixmpvQXMHYz2/H5/ssHbP1dm2RRNun:89Y8lJGU969ihk2/H5/bP1dm2wn
TLSH
T1C755D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\pywin32_system32\pythoncom312.dll
Size 674KB
SHA256 18e5d69b62110f48da01842f9ddfd99d06cc561f0866371714ec6534fcb4e5ec
MD5 cc599c27974d84acaf47399e36c59c1f
SHA1 85e583beeb85c17f7874de994558b7034f4363a0
SHA512 fa3b823422bb92b64ebce67d9eb5e9ec842a581af285a522e6677ac9e828ad71488ee2cecf00878069f6bf7bc5440528c35f258c872c0fad25e4406dd4519d07
SSDEEP 6144:Wt3rMY0H5MzNISH8fq8f4QqikHFEhlD2ILHzrNCKGxY3zpdzOAA0FP5NsF:WlwYtNjHOf442EPL3svEpdyOx2F
TLSH
T193E4395AB3E50691F63AA1BEC9139B03D2A2B4511742A7CF01A0C76F5FA73C5373A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\pywin32_system32\pywintypes312.dll
Size 133KB
SHA256 9bd7f8c39a84d7b1ea43bfcd33c04631c60f4ff28167e82bb21987cc1c353766
MD5 9840f2fbf3a5104e53a511ee4c194338
SHA1 4e746b03ab167b077ef4a37cd79801916a21b363
SHA512 8a075dd8bd7c5d183a5920cb734e28582f1fbd8f28d2770a8f1e1b06c5faf8faf62151feb7eeefc1ce2ef778bd80cf4ae39b1dd57dd493038fee9ba0a929359c
SSDEEP 3072:m36SA+jofbJJwwdOptiNrY/rZ6YrulfF14QgR5y189I6t04/:mFA+jofbDwCOpSrY/rPuF14QgDyS9IQ
TLSH
T18AD33A47379644DAE966937DCD771A02D3A2B0000711E3CF46A1C28B6F63BE6AD3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\win32\win32api.pyd
Size 135KB
SHA256 8e09d7aa57dc33b663afd219fab21b6a70e9d98cc74a044df4d6cd94799d98c2
MD5 47519e813fdb3c8ec27b2c15f3a89c39
SHA1 e73520dc43be875cf221f8a2a9e684577d9671c8
SHA512 18f365bfc2d68ba0dc9659e6264e40f6188831c32e45eb2cef32f842a916083c9417950566b9010fbb8d052435e1097e157a9c99f20785d9a1c9f0afbcb3b164
SSDEEP 3072:HdoqzVTT4Dfd3R8+2KVi6ElRVlhLaN/Pig6wqTmaSlDpgU0e:nzpYNR8+xVIlRVsPzqMppg
TLSH
T171D3F683B25410D6D86AA27CC1675B23D772B8240725A7CF0AA0C28B1F637E97D3DBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI53682\win32\win32event.pyd
Size 29KB
SHA256 a6b896456443447a663fe25783dfa95929dc8ade8d7970fd78d3b4e65100371e
MD5 c910aa8ea8db7a147adcd39b785e6f5f
SHA1 9cc495ff9487900b2658fa002762e76743b4b2c0
SHA512 1a844f575f8ca45967def7516f2db001f7604b0e383bc7096f27fe641a0c6ad857550cbeadc9f268ad1ecb9b8ffc07e093464e0081635fb60ebe76911aa9cb60
SSDEEP 768:S6+5FIwYS0Rj9cEbM/jhfWddbcr4i9jUmku36F3a/:SIZ/M/jhfWddbc0i9jUmku36F3a/
TLSH
T1E4D2E7C733A46096E526D13DC8661F07E2B2B57103A0B3DF0262D55A1F732E57A39F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4900-98-0x000001E5008D0000-0x000001E500B6E000-memory.dmp

Download