Analysis
- user interaction
yes - max time kernel
1800s - max time network
627s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 04:45
General
- Target MeowNetLauncher-win-Setup.exe
- Size 12.6MB
- Sample261102-fdp3sshs4n
- SHA256 ec35ea6dabcfcab838d17879b631c162f800c34eb3fc57b9cefad040ea52fb69
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 7 IoCs
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 16 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MeowNetLauncher-win-Setup.exe"C:\Users\Admin\AppData\Local\Temp\MeowNetLauncher-win-Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe"C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe" --veloapp-install 1.6.32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe"C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" -xf "F:\MeowNet\MeowNet.update.zip" -C "F:\MeowNet\.update-staging"3⤵
-
-
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" -xf "F:\MeowNet\MeowNet.data.zip" -C "F:\MeowNet\.data-staging"3⤵
-
-
F:\MeowNet\RecRoom.exe"F:\MeowNet\RecRoom.exe" +forcemode:vr3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
F:\MeowNet\UnityCrashHandler64.exe"F:\MeowNet\UnityCrashHandler64.exe" --attach 5332 25220533493764⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
F:\MeowNet\UnityCrashHandler64.exe"F:\MeowNet\UnityCrashHandler64.exe" "5332" "2522053349376"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Debugger Evasion
1Direct Volume Access
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
Update.exe
MeowNetLauncher.exe
sq.version
MeowNetLauncher-1.6.3-full.nupkg
velopack_MeowNetLauncher.log
sharedassets96.assets.resS
KittyPC.dll
MEOWNET
NOTICE.txt
NineLives.dll
RecRoom.exe
RecRoomLog.bat
Recroom_Release.exe
UnityCrashHandler64.exe
UnityPlayer.dll
baselib.dll
installscript.vdf
last_update.txt
steam_appid.txt
app.info
boot.config
global-metadata.dat
memory/5332-10004-0x0000024C96760000-0x0000024C9998C000-memory.dmp
memory/5332-10007-0x0000000180000000-0x0000000181F7F000-memory.dmp
memory/5332-9999-0x0000024C96760000-0x0000024C9998C000-memory.dmp
memory/5332-10002-0x0000024C96760000-0x0000024C9998C000-memory.dmp
memory/5332-10003-0x0000000180000000-0x0000000181F7F000-memory.dmp
memory/5332-10001-0x0000024C96760000-0x0000024C9998C000-memory.dmp
memory/5332-10005-0x0000000180000000-0x0000000181F7F000-memory.dmp
memory/5332-10000-0x0000024C96760000-0x0000024C9998C000-memory.dmp
memory/5332-10010-0x0000000180000000-0x0000000181F7F000-memory.dmp
memory/5332-10011-0x0000000180000000-0x0000000181F7F000-memory.dmp
memory/5332-10012-0x0000000180000000-0x0000000181F7F000-memory.dmp
memory/5332-9998-0x0000024C96760000-0x0000024C9998C000-memory.dmp
memory/5332-10024-0x0000000180000000-0x0000000181F7F000-memory.dmp
memory/5332-10025-0x0000024C96760000-0x0000024C9998C000-memory.dmp