Analysis
- user interaction
yes - max time kernel
135s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
27/08/2026, 02:05
General
- Target Synapse Launcher.exe
- Size 1.1MB
- Sample260827-cjcswayepf
- SHA256 453ca434580c037530743d0ae1f92279bfc14a2553fff955a812077f3c7a5f76
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
- Costura .NET executable packer 2 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Synapse X.exe
memory/4312-26-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/4312-1-0x00000000002C0000-0x00000000003DE000-memory.dmp
memory/4312-2-0x0000000007360000-0x0000000007440000-memory.dmp
memory/4312-3-0x000000000AC40000-0x000000000B1FA000-memory.dmp
memory/4312-4-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/4312-5-0x000000000A6C0000-0x000000000A752000-memory.dmp
memory/4312-6-0x0000000004FB0000-0x0000000004FBA000-memory.dmp
memory/4312-9-0x0000000074C02000-0x0000000074C03000-memory.dmp
memory/4312-0-0x0000000074C02000-0x0000000074C03000-memory.dmp
memory/4312-22-0x0000000074BF0000-0x00000000753AC000-memory.dmp
memory/4600-28-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/4600-35-0x00000202BC460000-0x00000202BC478000-memory.dmp
memory/4600-25-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/4600-21-0x000002029FD10000-0x000002029FFFC000-memory.dmp
memory/4600-27-0x00000202BA7D0000-0x00000202BAD28000-memory.dmp
memory/4600-23-0x00007FFFABD1F000-0x00007FFFABD20000-memory.dmp
memory/4600-29-0x00000202BB800000-0x00000202BBA1C000-memory.dmp
memory/4600-30-0x00000202BC1F0000-0x00000202BC2A2000-memory.dmp
memory/4600-37-0x00000202BA7B0000-0x00000202BA7B8000-memory.dmp
memory/4600-38-0x00000202A1F20000-0x00000202A1F2A000-memory.dmp
memory/4600-36-0x00000202A1F30000-0x00000202A1F3A000-memory.dmp
memory/4600-24-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp
memory/4600-34-0x00000202BA7A0000-0x00000202BA7A8000-memory.dmp
memory/4600-33-0x00000202BB7C0000-0x00000202BB7E6000-memory.dmp
memory/4600-32-0x00000202A1EC0000-0x00000202A1ECA000-memory.dmp
memory/4600-31-0x00000202BC3A0000-0x00000202BC454000-memory.dmp
memory/4600-39-0x00000202BC4C0000-0x00000202BC4D8000-memory.dmp
memory/4600-45-0x00000202BF450000-0x00000202BF472000-memory.dmp
memory/4600-46-0x00000202BFDF0000-0x00000202BFDFA000-memory.dmp
memory/4600-47-0x00000202BFE20000-0x00000202BFE32000-memory.dmp
memory/4600-50-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp