77ce50d440ec89a7da06a1188efe98e8732ae0a7b41f34547db6b798056c7b5f

Analysis

user interaction
yes
max time kernel
20s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HubLauncher.exe
Size 11.2MB
Sample260827-pyc4eahl7s
SHA256 77ce50d440ec89a7da06a1188efe98e8732ae0a7b41f34547db6b798056c7b5f
MD5 2325ca196f637df343bfc58422b24e14
SHA1 069499b3811cab6e9e873998f50a9dd620e4237c
SHA512 7204962b07368ad1a4ce9be1e7f1343388a0577c0aaa038fa04f9eb0f654876013c3cdf1c1be2b4aeebe12c4ed78b8f2ea59465131eea2ed3e63ba9d58a806f0
SSDEEP 196608:K/TYgNNWjM1NSqaL62SVqDGonH+F2EahbewiUWmSF5+cs5mXtbE0KDDS/DDD7/iI:oTP8jM1NSqaLPeXO1bUeU45mx1KDDS/Z
TLSH
T16CC633BC66C1DC1DEB6B2E3287F8A55CEB34613392C2E793359145794A523E04D02BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

costura defense_evasion discovery execution packer ransomware

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HubLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RYsfZ4PlQosW.exe

Executes dropped EXE 1 IoCs

pid	Process
396	RYsfZ4PlQosW.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x00090000000243e8-28.dat	costura

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RYsfZ4PlQosW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HubLauncher.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4116	timeout.exe
2552	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HubLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RYsfZ4PlQosW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RYsfZ4PlQosW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	RYsfZ4PlQosW.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HubLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HubLauncher.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1344	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4340	HubLauncher.exe
396	RYsfZ4PlQosW.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4340	HubLauncher.exe
Token: SeDebugPrivilege	396	RYsfZ4PlQosW.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1376	4340	HubLauncher.exe	84
PID 1376 wrote to memory of 4000	1376	csc.exe	86
PID 4340 wrote to memory of 3724	4340	HubLauncher.exe	88
PID 3724 wrote to memory of 2552	3724	cmd.exe	90
PID 3724 wrote to memory of 396	3724	cmd.exe	94
PID 3724 wrote to memory of 4116	3724	cmd.exe	95
PID 396 wrote to memory of 688	396	RYsfZ4PlQosW.exe	96
PID 688 wrote to memory of 4352	688	csc.exe	99

C:\Users\Admin\AppData\Local\Temp\HubLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\HubLauncher.exe"
1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\HubLauncher.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_c0767e34feeb4314b28e2ce51d3c959f.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3488.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4EC4594447784885BBC23A6CF0EEBC3.TMP"
    3⤵
    PID:4000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D0h34zXW.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\RYsfZ4PlQosW.exe
    "C:\Users\Admin\AppData\Local\Temp\RYsfZ4PlQosW.exe" --newcopy
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RYsfZ4PlQosW.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_653641f1733c426cbbca4d47eea98ed8.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:688
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES413A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF3C9573522AA4F7F85A5A7E8CA5F7C36.TMP"
        5⤵
        
        PID:4352
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4116

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HubLauncher_debug.log
1⤵
- Opens file in notepad (likely ransom note)
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D0h34zXW.bat

Path C:\Users\Admin\AppData\Local\Temp\D0h34zXW.bat
Size 219B
SHA256 c9fdddbe94b0a63fb5bdad767693ef5cb017bfe345cd28bce955372b5909762c
MD5 664724cc958f3d0d936f2026a7136d26
SHA1 f6d36e222a6bfbd02711ac06aa8bdad82d19887b
SHA512 5dcc20be78ccb71663802e4d2d4950a589128ba576fbf0fffbf2ad689cb09cb5068e158d47ca952c2bd2ec8464273c5423331c865f1d577b88df01e41e4999d4
TLSH
T1B1D0A70761A787D5044014A64EBE359A609A144A7D44F3D10251C46D474B42ABA877C5
MD5 SHA1 SHA512 TLSH

Submit Download

RES3488.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3488.tmp
Size 1KB
SHA256 82aed00f35621aa7a06824fb699877d265fcf5613b37d042e3aa78e6eac7d685
MD5 91b96379789588989f62934970a0d50b
SHA1 a98965c504d97d3bdf6c87a54cf8324c4ed1dfb1
SHA512 b48b673f3f7832210d55f35176142ed9d36a4dc8cfd86171068cbc866f26bfac044969e697b07edcd6411ae1a9e939edb08b8d712917371b5cca16a00a34ee03
TLSH
T18641330083D84B1FF273833128F74729A674FE65AFAE075EB484532E1E11644CD83AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES413A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES413A.tmp
Size 1KB
SHA256 8e8feecdad1e8e9604310d21be8dc68dc2b5538e2535382941c1fe55c5dfe353
MD5 282b8b885905e8aac1fd434990029f0c
SHA1 ed59a26313eaba08876a2eed1531a9d3fe755590
SHA512 529899a8a5683cdcfdd6e0af766f58b490ff9305c953736e047c4f76c52cbbfcdfc56bcf75877aee65cb540895d0715ddd33200c70a73e86209fabbb8ba0beab
TLSH
T17C414F4183E84B1EE172473129F78729E378BE559EAA475EB5C8163E1F02780DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RYsfZ4PlQosW.exe

Path C:\Users\Admin\AppData\Local\Temp\RYsfZ4PlQosW.exe
Size 11.2MB
SHA256 ee8079f4de18e2c0e33dcdfa9db26465443d0a4b439963569437466904b4cc4b
MD5 b015905b94f8ee9fc99fb31ed3411b4b
SHA1 b0dffa105fc9a885f6d1fedc429f246050e5612a
SHA512 e21cc685ce745a7a3310cc99d67bad31243c23a3e74d14f8d7e3bb7c4d873970fa5155f9ba38edee7dc4cd28c6ba3efc6664c82efe058165d0e9e49f7f49ba80
SSDEEP 196608:x/TYgNNWjM1NSqaL62SVqDGonH+F2EahbewiUWmSF5+cs5mXtbE0KDDS/DDD7/i0:FTP8jM1NSqaLPeXO1bUeU45mx1KDDS/t
TLSH
T1EBC633BC66C1DC1DEB6B2E3287F8A55CEB34613392C2E793359145794A523E04D02BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubLauncher_debug.log

Path C:\Users\Admin\Desktop\HubLauncher_debug.log
Size 300B
SHA256 b2987c116fb1dc8b1ea49290d1cc113894a44c4c2d258dc01544d804c31266f1
MD5 9e214364bf5d6857d7fa9583d13d97b6
SHA1 76a2c4f39a51bdea8d5150f55e100619a9d95853
SHA512 a8af273ab4c2fc965d6ce09b886fd69cf261bfa772863427cbe568308a8e548cea2f5441d01c33663c2a2b0b351c2155bb8ac741c0728a128935c3b7ac182482
TLSH
T166E0C2CE5B78C08C4A70D62621CE76F720EDAB1F4F001A76473142E40BC3A8E629217B
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4EC4594447784885BBC23A6CF0EEBC3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC4EC4594447784885BBC23A6CF0EEBC3.TMP
Size 1KB
SHA256 2932c97b5142ec43c76e48d9c3de9b1ed3cbf1e0f9b5b5740ad07d7a00bf23ef
MD5 e8a99ee314b74b29354a305344366e82
SHA1 dca59bbbd1b15d7462e597e105008e94a73f20b4
SHA512 07ff9cbdec7dc23be8b62f10ea28f907ea3d260e1f4f757158e3894ed18de2a31c2c32ad8177694b0a54c21367f47d32d910a6c3ca2df3180477632d0624a0af
TLSH
T1E621EF44A3E8421EF2B3473179F1836391A9BE669DBA43DC3488571B5F259408983AB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF3C9573522AA4F7F85A5A7E8CA5F7C36.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCF3C9573522AA4F7F85A5A7E8CA5F7C36.TMP
Size 1KB
SHA256 4f5d0cc1116238fd966e5607792042ac64fc6019f25f557e64cceac9971768b2
MD5 456800a957ee204614264905d6ba0035
SHA1 40e96c7951523ec6ee8665f9b59aab737b168cbd
SHA512 3c68a86168cd5c2ada3e0ed73645243c68ce4ac1a6b1eb1e0a98e1d060f05c0d8332a7c3b7d341cc7045feb01ae7bfd520ff5919b784f1f785174ef89a380196
TLSH
T16C218C81A3E8431EF2B38B7079F2C76291ACBE568D7E83EC74C81B5B1B15544C5936B2
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_c0767e34feeb4314b28e2ce51d3c959f.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_c0767e34feeb4314b28e2ce51d3c959f.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-29-0x0000000000F80000-0x0000000001AC0000-memory.dmp

Download

memory/396-37-0x00000000068A0000-0x00000000068C2000-memory.dmp

Download

memory/396-46-0x0000000006B00000-0x0000000006B08000-memory.dmp

Download

memory/396-48-0x000000000B410000-0x000000000B418000-memory.dmp

Download

memory/396-49-0x0000000007130000-0x0000000007168000-memory.dmp

Download

memory/396-50-0x0000000007110000-0x000000000711E000-memory.dmp

Download

memory/4340-0-0x0000000000E60000-0x00000000019A0000-memory.dmp

Download

memory/4340-9-0x0000000006780000-0x00000000067A2000-memory.dmp

Download

memory/4340-1-0x0000000006280000-0x0000000006290000-memory.dmp

Download