Analysis
- max time kernel
146s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 00:22
General
- Target launcher/fa_launcher.exe
- Size 1.1MB
- Sample260930-apajlaaf74
- SHA256 3f27966f89d1f14a2f22ac903d3961f0c039fdec5087b6d9d4dbdb366caab75f
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher\fa_launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher\fa_launcher.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\launcher\aria2c.exe"C:\Users\Admin\AppData\Local\Temp\launcher\aria2c.exe" --enable-rpc --rpc-listen-all=false --rpc-listen-port=6811 --rpc-secret=fa0e58ee33fcc620d8 --dir="C:\Users\Admin\AppData\Local\Temp\launcher\download" --continue=true --file-allocation=none --summary-interval=0 -q2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/748-31-0x00007FF709170000-0x00007FF7096DD000-memory.dmp
memory/3160-38-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-44-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-33-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-34-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-36-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-21-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-40-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-30-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-46-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-49-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-50-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-52-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-56-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp
memory/3160-58-0x00007FF6F0440000-0x00007FF6F0568000-memory.dmp