Overview
overview
7Static
static
3recycle-la...up.exe
windows10-ltsc_2021-x64
7recycle-la...up.exe
windows11-ltsc_2024-x64
7DepotDownloader.exe
windows10-ltsc_2021-x64
1DepotDownloader.exe
windows11-ltsc_2024-x64
1ReCyclePatcher.exe
windows10-ltsc_2021-x64
1ReCyclePatcher.exe
windows11-ltsc_2024-x64
1recycle-launcher.exe
windows10-ltsc_2021-x64
6recycle-launcher.exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
300s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
recycle-launcher_0.6.69_x64-setup.exe
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral2
Sample
recycle-launcher_0.6.69_x64-setup.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
DepotDownloader.exe
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral4
Sample
DepotDownloader.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
ReCyclePatcher.exe
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral6
Sample
ReCyclePatcher.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
recycle-launcher.exe
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral8
Sample
recycle-launcher.exe
Resource
win11ltsc2024-20260911-en
General
- Target recycle-launcher_0.6.69_x64-setup.exe
- Size 66.5MB
- Sample261014-espvxayshy
- SHA256 13ee1c9263f2a3637bbc16d38dc704a873b432f9b4cdf4414c45f322d4febb98
- MD5 154ad720e505f204c1619d67d550ec94
- SHA1 8035e02f5489a8e4955eaf6e629742d86b39c5d9
- SHA512 1ac95a395d711b3a2fc9b0e90f047e08c006683bacb9ced946eaf7c945d6dc499edbf0c2da44b15e22a81b63fb625b2ad971e86295c3168f699fee04d76783d6
- SSDEEP 1572864:tPcuFlKeOX9gqRR6zlJhYmGW7ZS2fadRHbQL7fLeYnv+UlBLc+Ol7RZV31o1:tEMONZRR6BJGjW7A2faPcL7qKDLcXtlA
- TLSH T1E8E73389AFE45563DA76C7BDC88EB9BDC77AD2C226784B71D432C780AAC801D0F5D442
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 952 recycle-launcher_0.6.69_x64-setup.exe 952 recycle-launcher_0.6.69_x64-setup.exe 952 recycle-launcher_0.6.69_x64-setup.exe 952 recycle-launcher_0.6.69_x64-setup.exe 952 recycle-launcher_0.6.69_x64-setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language recycle-launcher_0.6.69_x64-setup.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\shell\open\command recycle-launcher_0.6.69_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\recycle-launcher\\recycle-launcher.exe\" \"%1\"" recycle-launcher_0.6.69_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\ = "URL:recycle-launcher protocol" recycle-launcher_0.6.69_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\DefaultIcon recycle-launcher_0.6.69_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\recycle-launcher\\recycle-launcher.exe\",0" recycle-launcher_0.6.69_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\shell recycle-launcher_0.6.69_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\shell\open recycle-launcher_0.6.69_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle recycle-launcher_0.6.69_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\recycle\URL Protocol recycle-launcher_0.6.69_x64-setup.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 952 recycle-launcher_0.6.69_x64-setup.exe 952 recycle-launcher_0.6.69_x64-setup.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsl6A0D.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl6A0D.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 0c1963e9ee5a1ddda679434e9698165d330d7c6b7295737203d31e5371715b1c
- MD5 f348cf2760abfacc5430b82891fc4d5b
- SHA1 8fb7f0c8cfcb1aba9ab3db2e9bb8fb832d1ccd4f
- SHA512 34bcf542cf6de674e67458d3f6b73faa4c787d62f97a063b985c2d1e2e757495f69db00f32efa2be9823912211d2ea2e8149d2bdc2ed6b69aef9fa90364f154a
- SSDEEP 1536:rCmiwJC/O/Ugg///wEQR0M4xZUGRUUUU6MX0y2g8zqDMHYMYF20hiLJHndceeRKc:JbR0M4xX5zTYqDMHYM9LJHbG
- TLSH T1F2E308A1ACF85AA6403DC2D24C563DAD9D2E0CDCDA65A143ADD3F268A7344ED4CFCB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl6A0D.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl6A0D.tmp\nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\recycle-launcher\recycle-launcher.exe
- Size 6.8MB
- SHA256 a87cedb6644556cbec3c5ba8ec0385b0936357742396d202c094328c286652c6
- MD5 4c720b45728678dc3126cbd377567391
- SHA1 0920f3bb87091438fe72e6768a3f5a5ac06a04ea
- SHA512 a70b2ae04912dd1b730f04a49fbb5e4cb1db49c17b0431df2a31b036328d4aaec6c9e5082f40f8c336648887d2a6de0ffce46420c9c15d633bcdb87eb1f6b3ef
- SSDEEP 98304:tAb43rbxGL30HzwRfbzbVCY9cJgwf7Vx+Yh0WtIYwn+:D3r3HzcNWgo7VZh0rZ
- TLSH T151668E43F2A181E9C05EC178935AA233F732B8890A34B2FB5BD45B212F66F506F1D759
- MD5 SHA1 SHA512 SSDEEP TLSH