Analysis
- max time kernel
148s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 04:24
General
- Target ECLIPSE-Launcher-1.0.0-beta.66.exe
- Size 103.8MB
- Sample261030-e1d4dahs21
- SHA256 a82ec0da24b166e40af8a72b7d1ffacb5b8709e8c2aa06af6465984f6ef468ae
Malware Config
Signatures
- Loads dropped DLL 9 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ECLIPSE-Launcher-1.0.0-beta.66.exe"C:\Users\Admin\AppData\Local\Temp\ECLIPSE-Launcher-1.0.0-beta.66.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\eclipse-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
eclipse-client.ecl
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
__PSScriptPolicyTest_41c0fdqh.ux2.ps1
chrome_100_percent.pak
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
memory/1128-63-0x0000000005280000-0x0000000005290000-memory.dmp
memory/1128-72-0x000000006F390000-0x000000006F3DC000-memory.dmp
memory/1128-81-0x0000000007E50000-0x0000000007E61000-memory.dmp
memory/1128-80-0x0000000007EE0000-0x0000000007F76000-memory.dmp
memory/2608-55-0x000000006FB10000-0x000000006FE64000-memory.dmp
memory/2608-33-0x0000000005BD0000-0x0000000005F24000-memory.dmp
memory/2608-36-0x0000000006210000-0x000000000622E000-memory.dmp
memory/2608-49-0x0000000007410000-0x00000000074B3000-memory.dmp
memory/2608-50-0x0000000007BA0000-0x000000000821A000-memory.dmp
memory/2608-51-0x0000000007550000-0x000000000756A000-memory.dmp
memory/2608-52-0x00000000075C0000-0x00000000075CA000-memory.dmp
memory/2608-53-0x0000000007740000-0x000000000776A000-memory.dmp
memory/2608-54-0x0000000007770000-0x0000000007794000-memory.dmp
memory/2608-48-0x00000000067A0000-0x00000000067BE000-memory.dmp
memory/2608-38-0x000000007F680000-0x000000007F690000-memory.dmp
memory/2608-37-0x0000000006230000-0x000000000627C000-memory.dmp
memory/2608-39-0x00000000071D0000-0x0000000007202000-memory.dmp
memory/2608-26-0x0000000005A70000-0x0000000005AD6000-memory.dmp
memory/2608-27-0x0000000005AE0000-0x0000000005B46000-memory.dmp
memory/2608-25-0x0000000005270000-0x0000000005292000-memory.dmp
memory/2608-24-0x0000000005340000-0x0000000005968000-memory.dmp
memory/2608-23-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/2608-22-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/2608-21-0x0000000004D00000-0x0000000004D10000-memory.dmp
memory/2608-40-0x000000006F390000-0x000000006F3DC000-memory.dmp
memory/2892-94-0x00000000060F0000-0x0000000006444000-memory.dmp
memory/2892-96-0x000000006F390000-0x000000006F3DC000-memory.dmp
memory/2892-104-0x000000006F510000-0x000000006F864000-memory.dmp