Analysis
- user interaction
yes - max time kernel
76s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ArmaLauncherClient.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ArmaLauncherClient.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target ArmaLauncherClient.exe
- Size 75.3MB
- Sample260825-mdvrlsgg24
- SHA256 eddf123ea0fc47fab5bc9d4e04a6dbac5d48949a91a713d6f28b9f7daa115a37
- MD5 4016446a2162e821488851d543631d50
- SHA1 aeac7542ad76ec99cf2e21b9e4a76efbb06b5922
- SHA512 68494c512b5a6d64f17a6d1fac42ff93db9630d4a5d4f8e57c0a4d27c0501c0cf65ea822ba4865c32dbcd99ec09ccc83e23f25139308cd1db0ef0e338ab81cd4
- SSDEEP 1572864:oOfNuuii2WpfnctRbAEk5KM0BW84OQf0IM8IungjMke8QQqJ19Ngm77x:oOhEn9p9Q86IunmMp8qnNr7V
- TLSH T129082357E2F900E8D4BBC0B8CA5B4627EBB13455132457EB22A48A692F37FE15E7D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4972 ArmaLauncherClient.exe 4972 ArmaLauncherClient.exe 4972 ArmaLauncherClient.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4972 ArmaLauncherClient.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\ArmaLauncherClient\w6_-lWDNyMaD\D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\ArmaLauncherClient\w6_-lWDNyMaD\PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 58c4e1174515ec7d07dc6b1a5c258aae88572576e1bc9f09ea92e555752b2554
- MD5 e10a0ec11f249c021024a81905d12464
- SHA1 3ec0392cc1396d6bf001ad033acaafdf8f09f29f
- SHA512 4820510e0237078c7f3f74bc6d0eee02e1ca275436b4099c6e0d520bbfb2cd63b4d010286ad170796f0905a63f8fe8a9154acd8c17ff4837cdf42d3d56ffef54
- SSDEEP 24576:uGD+42x2Jvddeoyo7Pkmn/V1Pt8clT3D4iLFxVCPL67uMFAC0q4dovzvfPbRnR9C:+2BzeoRPkmTP2clT31wPO7hACNYovzns
- TLSH T135454A62E2E642E5C47FC1B8C6469717FBB0740A131C66DB87608B592F27FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\ArmaLauncherClient\w6_-lWDNyMaD\wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 098d9cefaca7b1e36460eb28f2725d7afdb8e93855c29f8dd3627a1fb692ae8e
- MD5 f22b637c7ac66f9c13bca4059babe75d
- SHA1 28637745b2e5c913df87756ea163a6bc1485bbc9
- SHA512 dd4204b7001fc2440d83dfefd2191ce0e3a4c94fc6222aa3d3af28464c668d4742e90fa3c45c27d4fce56de07dfd2d7a7374fae315f32d97d6968b304478526c
- SSDEEP 24576:4X0ECpcq1uFKlvkW3GRnGdMPVCSbzPOI2NCmlydYbpg85Vay2JeipNU4slL:kBmUqvkWsGdE9Pt24msMpg8Wy2JwvF
- TLSH T19B955A4AB6AC40E9D07AD23CD9D7961FF63178142B61A7CF23A0479D6F27BD0097A360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\launcher.log
- Size 1KB
- SHA256 8eac9e1509a326eda32f3704bb9d631fa4ac8cf4e40ebefb870c4dcd233e40b5
- MD5 ac7a9624790652d7eedad39dfb05828b
- SHA1 092e21d20c344a72cafa5e2a7c8de5f27dfa9292
- SHA512 b90a197eca3fb520525bafe74fc561e03e57612a53031a3580ce6c681432c9284d11d81e0fd2c05628f97dc8a8c711f78949aa457ae6c5813c4e2ac7beddfa02
- TLSH T1DA2153DAC5F75DEA440A8C1305FDA49DA0A409082F21B6F83A3D5CF90182C9CBDB343E
- MD5 SHA1 SHA512 TLSH