Analysis
- user interaction
yes - max time kernel
9s - max time network
6s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
24/09/2026, 04:06
General
- Target Launcher.dll
- Size 108KB
- Sample260924-ephx7adf74
- SHA256 5a6f9c6292c7ac82684bf9360d5529563cff134529e03ff4f4d62955ff05947f
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 20 IoCs
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Launcher.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\0ce6fe0e.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tar.exe"tar" -xf "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" -C "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex"3⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
get-pip.py
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python.exe
python.zip
python3.DLL
python312._pth
python312.dll
python312.zip
select.pyd
unicodedata.pyd
vcruntime140_1.dll
0ce6fe0e.ps1
__PSScriptPolicyTest_1qtu5f40.uis.ps1
cacert.pem
pip.zip
memory/1608-2-0x000001AFF59D0000-0x000001AFF59F2000-memory.dmp
memory/1608-1-0x000001AFD9D70000-0x000001AFD9D80000-memory.dmp
memory/1608-11-0x000001AFF5A40000-0x000001AFF5A5C000-memory.dmp
memory/1608-9-0x000001AFD9D70000-0x000001AFD9D80000-memory.dmp
memory/1608-12-0x000001AFD9DF0000-0x000001AFD9DF6000-memory.dmp
memory/1608-763-0x000001AFD9D70000-0x000001AFD9D80000-memory.dmp