Analysis
- max time kernel
34s - max time network
19s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 09:11
General
- Target HexiumLauncher.exe
- Size 66.0MB
- Sample261011-k5yapsfb47
- SHA256 08dd1447ca68fef20eb4025197c462fb1bdc56d5328613ddb646ac7191ac189e
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HexiumLauncher.exe"C:\Users\Admin\AppData\Local\Temp\HexiumLauncher.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1764-6-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/1764-47-0x000001CAF0D80000-0x000001CAF0D87000-memory.dmp
memory/1764-50-0x000001CAF0DB0000-0x000001CAF0DBA000-memory.dmp
memory/1764-27-0x000001CAF18B0000-0x000001CAF19AE000-memory.dmp
memory/1764-53-0x000001CAF15E0000-0x000001CAF15F6000-memory.dmp
memory/1764-44-0x000001CAF1660000-0x000001CAF169E000-memory.dmp
memory/1764-9-0x000001CAF2760000-0x000001CAF3411000-memory.dmp
memory/1764-41-0x000001CAF1610000-0x000001CAF1657000-memory.dmp
memory/1764-35-0x000001CAF0F00000-0x000001CAF0F21000-memory.dmp
memory/1764-24-0x000001CAF0D90000-0x000001CAF0DA8000-memory.dmp
memory/1764-21-0x000001CAF0D40000-0x000001CAF0D60000-memory.dmp
memory/1764-18-0x000001CAEF4F0000-0x000001CAEF4FD000-memory.dmp
memory/1764-16-0x000001CAEF510000-0x000001CAEF522000-memory.dmp
memory/1764-12-0x000001CAF16E0000-0x000001CAF17A1000-memory.dmp
memory/1764-38-0x000001CAF1040000-0x000001CAF1080000-memory.dmp
memory/1764-30-0x000001CAF0EE0000-0x000001CAF0EF3000-memory.dmp
memory/1764-15-0x000001CAEF510000-0x000001CAEF522000-memory.dmp
memory/1764-56-0x000001CAF1820000-0x000001CAF1836000-memory.dmp
memory/1764-59-0x000001CAF1860000-0x000001CAF1879000-memory.dmp
memory/1764-63-0x000001CAF4CE0000-0x000001CAF4D95000-memory.dmp
memory/1764-65-0x000001CAF7720000-0x000001CAF78D8000-memory.dmp
memory/1764-68-0x000001CAF26B0000-0x000001CAF26E4000-memory.dmp
memory/1764-71-0x000001CAF2730000-0x000001CAF275A000-memory.dmp
memory/1764-80-0x000001CAF4BE0000-0x000001CAF4C01000-memory.dmp
memory/1764-74-0x000001CAF8C50000-0x000001CAF8DBA000-memory.dmp
memory/1764-83-0x000001CAF4E40000-0x000001CAF4E9C000-memory.dmp
memory/1764-86-0x000001CAF8DC0000-0x000001CAF8E67000-memory.dmp
memory/1764-77-0x000001CAF4C20000-0x000001CAF4CAA000-memory.dmp
memory/1764-89-0x000001CAF4EA0000-0x000001CAF4EDC000-memory.dmp
memory/1764-92-0x000001CAF4DA0000-0x000001CAF4E1C000-memory.dmp
memory/1764-95-0x000001CAF4E20000-0x000001CAF4E39000-memory.dmp
memory/1764-101-0x000001CAF4EE0000-0x000001CAF4EF7000-memory.dmp
memory/1764-98-0x000001CAF4F30000-0x000001CAF4F55000-memory.dmp
memory/1764-104-0x000001CAF4FB0000-0x000001CAF4FC7000-memory.dmp
memory/1764-107-0x000001CAF50D0000-0x000001CAF50F0000-memory.dmp
memory/1764-110-0x000001CAF50F0000-0x000001CAF50F6000-memory.dmp
memory/1764-114-0x000001CAF8FB0000-0x000001CAF9074000-memory.dmp
memory/1764-116-0x000001CAF5120000-0x000001CAF5125000-memory.dmp
memory/1764-127-0x000001CAF8E70000-0x000001CAF8E7F000-memory.dmp
memory/1764-130-0x000001CAF8E80000-0x000001CAF8E89000-memory.dmp
memory/1764-133-0x000001CAF8F30000-0x000001CAF8F85000-memory.dmp
memory/1764-124-0x000001CAF5130000-0x000001CAF5159000-memory.dmp