d7508c0022d959e4566d2cc1742cc0b7752b6fd1e692ecab7cef7ac6b9d8eec3

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Prestige Launcher.exe
Size 232KB
Sample261012-zrbbcazzhs
SHA256 d7508c0022d959e4566d2cc1742cc0b7752b6fd1e692ecab7cef7ac6b9d8eec3
MD5 a802560cc00c14f811f003991a717e8c
SHA1 c6bbd6f188ff975ad0a48e7d82644a3a1f45a8b1
SHA512 bbf381bc4b931b207ce3f3a61cd880cdafd2e300adc9b6745ed5223356104598e07e546bbcd6dd5a3d871979673d2ae13b3c048db8f150f8da8f8081d0291d34
SSDEEP 3072:RwjdFkl6R2AsMLLSjusIjpqRCfl1BabQHB5RWWKuQNUrYnpZi+4Muyspp:R4+6RFLujusSDnTG/i7MHspp
TLSH
T1E834BE97B3E130F8E577823486A14A46F773B93507218BEF03A4426A5F272D59D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5560	Prestige Launcher.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Prestige Launcher.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Prestige Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Prestige Launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5560	Prestige Launcher.exe
5560	Prestige Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5560	Prestige Launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5560	Prestige Launcher.exe

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	6	curl/8.0.0

C:\Users\Admin\AppData\Local\Temp\Prestige Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Prestige Launcher.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5560-8-0x0000000180000000-0x00000001804BC000-memory.dmp

Download

memory/5560-1-0x0000000180000000-0x00000001804BC000-memory.dmp

Download

memory/5560-10-0x0000000180000000-0x00000001804BC000-memory.dmp

Download