343252a6f62456b1ac10e486308f8665abc26d3a8ab87ddd1dfd8bded22191b1

Analysis

max time kernel
303s
max time network
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CSR Launcher.exe
Size 220.8MB
Sample260820-vbprksvsgz
SHA256 343252a6f62456b1ac10e486308f8665abc26d3a8ab87ddd1dfd8bded22191b1
MD5 a29e9063aa1448d2e911ee00dfddaa3b
SHA1 04e5ef84a5a1c8465d71f84a071a22b2e4c53d09
SHA512 291054bbceeea6be23d94e5d17e83dc71ae01ee60311dd3c63264780c976fc21e779ca97ecedde27a3096f5e78f261ccf4d0f79219a14b792a0711594d929509
SSDEEP 1572864:iVjgSYwyLxU6sOtg7u3Vu6lNy2FAHDYU5/KdwQZaDKH9WK6BLd78XKSw9N360ari:cwLxT3NnzoOkIb2
TLSH
T100B88C03F29A41D9C06DD1798B5B9633FE71B8454B24A3DF2B5407922F66EE82B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CSR Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CSR Launcher.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\discord-1334635675403685908\shell\open\command	CSR Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\discord-1334635675403685908\shell	CSR Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\discord-1334635675403685908\shell\open	CSR Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\discord-1334635675403685908\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CSR Launcher.exe\" \"%1\""	CSR Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\discord-1334635675403685908	CSR Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\discord-1334635675403685908\URL Protocol	CSR Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\discord-1334635675403685908\ = "URL:discord-1334635675403685908"	CSR Launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
988	CSR Launcher.exe
988	CSR Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe
Token: SeShutdownPrivilege	2572	CSR Launcher.exe
Token: SeCreatePagefilePrivilege	2572	CSR Launcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 5800	2572	CSR Launcher.exe	89
PID 2572 wrote to memory of 5812	2572	CSR Launcher.exe	88
PID 2572 wrote to memory of 4720	2572	CSR Launcher.exe	90
PID 2572 wrote to memory of 988	2572	CSR Launcher.exe	92

C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\csr-launcher" --field-trial-handle=1796,i,17538777987381995715,2492761482352762517,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1800,i,7473202211190790902,15669924684043869704,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1832 /prefetch:11
  2⤵
  PID:5812
- C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\csr-launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,17538777987381995715,2492761482352762517,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1800,i,7473202211190790902,15669924684043869704,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:5800
- C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\csr-launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1796,i,17538777987381995715,2492761482352762517,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1800,i,7473202211190790902,15669924684043869704,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2468 /prefetch:1
  2⤵
  PID:4720
- C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\CSR Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\csr-launcher" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,17538777987381995715,2492761482352762517,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1800,i,7473202211190790902,15669924684043869704,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3656 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\csr-launcher\Network\Network Persistent State
Size 994B
SHA256 bab1e175dc346731650c1cca160bc2c77fe93346b3fe43e3d90b9374bc5eb435
MD5 3976f9545febb8040283d53d693430ac
SHA1 ca185da69a8a608a46850cb0b739d26b9af756e2
SHA512 ea5069929e5a08644454798e554c62da852981dbab39a5fa202a4fc764ec907ad67a67774e07e2ad0fa8e1e818e9d3992726840b21dab3a3270fd228942251ff
TLSH
T1E11157D6C7E846BE896263F52B353D63C5AE191842683C0789E9EF8F93E1475860068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\csr-launcher\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-102-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/988-96-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/988-98-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/988-107-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/988-106-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/988-104-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/988-105-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/988-103-0x00000198F7470000-0x00000198F7471000-memory.dmp

Download

memory/4720-41-0x00007FFB9BF90000-0x00007FFB9BF91000-memory.dmp

Download

memory/4720-40-0x00007FFB9AEE0000-0x00007FFB9AEE1000-memory.dmp

Download

memory/5800-78-0x00000203E4B20000-0x00000203E4FAD000-memory.dmp

Download

memory/5800-74-0x00000203E4B20000-0x00000203E4FAD000-memory.dmp

Download