Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 02:49
General
- Target yuzu_Early_Access_Launcher.exe
- Size 3.0MB
- Sample261027-da27vaxy7m
- SHA256 0a4ad8e114936a962ad5307e9e28c5a6f31fd9deb360d027db3370437c1221e3
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\yuzu_Early_Access_Launcher.exe"C:\Users\Admin\AppData\Local\Temp\yuzu_Early_Access_Launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\yuzu\yuzu Early Access Launcher.exe"C:\Users\Admin\AppData\Local\yuzu\yuzu Early Access Launcher.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
launcher.ini
launcher.ini
yuzu Early Access Launcher.exe
yuzu Early Access Launcher.lnk
memory/2224-15-0x000001A868D10000-0x000001A868D20000-memory.dmp
memory/2224-16-0x000001A868CB0000-0x000001A868CCE000-memory.dmp
memory/2224-33-0x000001A8740B0000-0x000001A8740D6000-memory.dmp
memory/2224-32-0x000001A868E60000-0x000001A868EAC000-memory.dmp
memory/2224-34-0x000001A868CE0000-0x000001A868CE8000-memory.dmp
memory/2224-37-0x000001A868D10000-0x000001A868D20000-memory.dmp
memory/4548-0-0x000001B5C9CD0000-0x000001B5C9FCE000-memory.dmp
memory/4548-2-0x000001B5CBB20000-0x000001B5CBB30000-memory.dmp
memory/4548-1-0x000001B5E4480000-0x000001B5E44F6000-memory.dmp