77ce50d440ec89a7da06a1188efe98e8732ae0a7b41f34547db6b798056c7b5f

Analysis

user interaction
yes
max time kernel
13s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HubLauncher.exe
Size 11.2MB
Sample260827-pyc4eahl7s
SHA256 77ce50d440ec89a7da06a1188efe98e8732ae0a7b41f34547db6b798056c7b5f
MD5 2325ca196f637df343bfc58422b24e14
SHA1 069499b3811cab6e9e873998f50a9dd620e4237c
SHA512 7204962b07368ad1a4ce9be1e7f1343388a0577c0aaa038fa04f9eb0f654876013c3cdf1c1be2b4aeebe12c4ed78b8f2ea59465131eea2ed3e63ba9d58a806f0
SSDEEP 196608:K/TYgNNWjM1NSqaL62SVqDGonH+F2EahbewiUWmSF5+cs5mXtbE0KDDS/DDD7/iI:oTP8jM1NSqaLPeXO1bUeU45mx1KDDS/Z
TLSH
T16CC633BC66C1DC1DEB6B2E3287F8A55CEB34613392C2E793359145794A523E04D02BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

costura defense_evasion discovery execution packer

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HubLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	62oSYA2NpnsR.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	62oSYA2NpnsR.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e00000001c456-28.dat	costura

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5740	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62oSYA2NpnsR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HubLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2612	timeout.exe
2492	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	62oSYA2NpnsR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	62oSYA2NpnsR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	62oSYA2NpnsR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HubLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HubLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HubLauncher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1212	HubLauncher.exe
2096	62oSYA2NpnsR.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	HubLauncher.exe
Token: SeDebugPrivilege	2096	62oSYA2NpnsR.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 3124	1212	HubLauncher.exe	89
PID 3124 wrote to memory of 4548	3124	csc.exe	91
PID 1212 wrote to memory of 5740	1212	HubLauncher.exe	92
PID 5740 wrote to memory of 2612	5740	cmd.exe	94
PID 5740 wrote to memory of 2096	5740	cmd.exe	96
PID 5740 wrote to memory of 2492	5740	cmd.exe	97
PID 2096 wrote to memory of 5648	2096	62oSYA2NpnsR.exe	98
PID 5648 wrote to memory of 3708	5648	csc.exe	100

C:\Users\Admin\AppData\Local\Temp\HubLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\HubLauncher.exe"
1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\HubLauncher.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_341d9bb892f14ef3a2fd364c770e8252.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD93.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6BB3289E3A648559109C3F3AE87B41.TMP"
    3⤵
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gOXKjuAf.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\62oSYA2NpnsR.exe
    "C:\Users\Admin\AppData\Local\Temp\62oSYA2NpnsR.exe" --newcopy
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\62oSYA2NpnsR.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_dd9def7eac0540679d10fa1f3202e504.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5648
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2159.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD92AF0FEDFC941A5A0EC6C381E51C2BA.TMP"
        5⤵
        
        PID:3708
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

62oSYA2NpnsR.exe

Path C:\Users\Admin\AppData\Local\Temp\62oSYA2NpnsR.exe
Size 11.2MB
SHA256 80e2e56d69c2dd6f2d18ce7913ffa93d3281121a13368b50b89e7ed7ae6a893b
MD5 19902703945d0aabafb4c5ea7d8065f5
SHA1 e319e740008c696b303c718d67eb351cde5a09ea
SHA512 f727e7400bedb991b9b3166ff650c82743c1651d1515b4dca25952d04b4ae895d524dcd9fe297f0fa16e6d4b8b9cf2d9256a9da5d86387660201c87c2d95b9c4
SSDEEP 196608:o/TYgNNWjM1NSqaL62SVqDGonH+F2EahbewiUWmSF5+cs5mXtbE0KDDS/DDD7/i9:iTP8jM1NSqaLPeXO1bUeU45mx1KDDS/Y
TLSH
T1B7C633BC66C1DC1DEB6B2E3287F8A55CEB34613392C2E793359145794A523E04D02BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2159.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2159.tmp
Size 1KB
SHA256 8905b17a79e429882ebef9bcd88fbfd8131df6dacf3fcc43c7425f5ef0c506eb
MD5 adbbf79e9cc94efc3d86f778f7d86c27
SHA1 e3dba5d37890e1fa2d66fd69cd93b420a334e7de
SHA512 1f8305cdc3b0b349077425f12d0a3d3958a32627f704144002bc3858eb40904a44da6e7f22f7165c8a88cd04c62487d2318fed9b12ed26e2f796edb479f8238e
TLSH
T1F241410193E88B1FE132833139F7872AE678BE95AE99575D75C8123F1E02640DDC32B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESD93.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD93.tmp
Size 1KB
SHA256 defa75782e0d725b49b66f2ae390c8aeb58a3120d83c5ca340d5c368420df979
MD5 dc2901569aee880d960d0509fe2ca81a
SHA1 817086df3b9486c036711248d2ec69ff2110af04
SHA512 9fc67146ce3aba01e4b14e01f92787f0569769227bd799d0bf54750b06b6f45525b4c2d066b61355f65c3233b8606d4798fe7c9d40bb3179307375c5eae12a5c
TLSH
T1FB413300C3D84B1FE273433269F7831AA674FE5AAFAA875D7584522E1E12744DEC3671
MD5 SHA1 SHA512 TLSH

Submit Download

gOXKjuAf.bat

Path C:\Users\Admin\AppData\Local\Temp\gOXKjuAf.bat
Size 219B
SHA256 3e07f70367f05fe7f9e2cf26301c71d6555fa05e5bb96ad33fcbc87dde7612ba
MD5 891cf61603ca260419501e99dda026b6
SHA1 4f9f8c926dfd669f24a5ebc73f413022c15bfb24
SHA512 bd04d9a12dcb8df1b993a70c84d663780b67be9c954102b2ba63e68fcd107be2e0e37b2616334863c5f9abc33a8f3f5c5e6a86d25a49136a7271663b253b541e
TLSH
T15AD0A70360A787C5044014A749BF3189709A144B7D04B7D10611C52D4B4B41EAA876C9
MD5 SHA1 SHA512 TLSH

Submit Download

HubLauncher_debug.log

Path C:\Users\Admin\Desktop\HubLauncher_debug.log
Size 300B
SHA256 8f1ca6b7a601bcf7cb7d56fc626b5df0e91a49fd9eb039276f08afc7b24216b4
MD5 d65b5322914d7d6464c76db80fac7799
SHA1 b84ede2ab28dc70beae6ee3df3bf79cc3f983224
SHA512 022a29f3ec7aa18571243e2ffe091d7810962b07c818c56dfb18f8110093f16ca019794590ee93805fe952c373a951fbc4b0e58cb3083e7a7fa7f7332c86dd12
TLSH
T101E02B471970E09406B1727600FC97FB24EA8303CB40FA6417B593CC49976CF62A12B3
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6BB3289E3A648559109C3F3AE87B41.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC6BB3289E3A648559109C3F3AE87B41.TMP
Size 1KB
SHA256 2932c97b5142ec43c76e48d9c3de9b1ed3cbf1e0f9b5b5740ad07d7a00bf23ef
MD5 e8a99ee314b74b29354a305344366e82
SHA1 dca59bbbd1b15d7462e597e105008e94a73f20b4
SHA512 07ff9cbdec7dc23be8b62f10ea28f907ea3d260e1f4f757158e3894ed18de2a31c2c32ad8177694b0a54c21367f47d32d910a6c3ca2df3180477632d0624a0af
TLSH
T1E621EF44A3E8421EF2B3473179F1836391A9BE669DBA43DC3488571B5F259408983AB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD92AF0FEDFC941A5A0EC6C381E51C2BA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD92AF0FEDFC941A5A0EC6C381E51C2BA.TMP
Size 1KB
SHA256 647213637a587af0a36ea95edd9df8d48909bc8d5702a4e85843abd3f0e9f8d1
MD5 ad56bd1be751a1730fa42eeac974c5c1
SHA1 ae38aa7bc15d964e8ea7e760b8a2d86a6a229de3
SHA512 ba0c61632d7b32cae14d82d1ea3a53676ff303b2c4868e121ddd493721acef4c76ba915bca9dcb0a26e5f74f9619ce080c790cc7f62e9380bb1058716bb3481a
TLSH
T11C21CC45A3E8421EF2B3873039F28373D16C7E569D7A83EC34C8175B1F1694085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_341d9bb892f14ef3a2fd364c770e8252.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_341d9bb892f14ef3a2fd364c770e8252.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-0-0x00000000745C2000-0x00000000745C3000-memory.dmp

Download

memory/1212-10-0x0000000006EF0000-0x0000000006F12000-memory.dmp

Download

memory/1212-3-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/1212-26-0x00000000745B0000-0x0000000074D6C000-memory.dmp

Download

memory/1212-1-0x0000000000A40000-0x0000000001580000-memory.dmp

Download

memory/2096-30-0x0000000000F80000-0x0000000001AC0000-memory.dmp

Download

memory/2096-38-0x00000000063C0000-0x00000000063E2000-memory.dmp

Download

memory/2096-47-0x0000000007510000-0x0000000007518000-memory.dmp

Download

memory/2096-49-0x000000000BB30000-0x000000000BB38000-memory.dmp

Download

memory/2096-50-0x000000000BCC0000-0x000000000BCFE000-memory.dmp

Download

memory/2096-51-0x000000000BCA0000-0x000000000BCAE000-memory.dmp

Download