Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 00:22
General
- Target launcher/fa_launcher.exe
- Size 1.1MB
- Sample260930-apajlaaf74
- SHA256 3f27966f89d1f14a2f22ac903d3961f0c039fdec5087b6d9d4dbdb366caab75f
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher\fa_launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher\fa_launcher.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\launcher\aria2c.exe"C:\Users\Admin\AppData\Local\Temp\launcher\aria2c.exe" --enable-rpc --rpc-listen-all=false --rpc-listen-port=6811 --rpc-secret=fa0e59210bc74f25a4 --dir="C:\Users\Admin\AppData\Local\Temp\launcher\download" --continue=true --file-allocation=none --summary-interval=0 -q2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/756-31-0x00007FF722590000-0x00007FF722AFD000-memory.dmp
memory/1252-38-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-44-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-32-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-34-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-36-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-25-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-43-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-30-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-46-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-48-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-50-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-52-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-57-0x00007FF624950000-0x00007FF624A78000-memory.dmp
memory/1252-58-0x00007FF624950000-0x00007FF624A78000-memory.dmp