00438aee58f588a4b4199038020349da36a2b5def64041bad904454a3f5ea750

Analysis

max time kernel
209s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NodeNetLauncherSetup-1.0.24.exe
Size 106.7MB
Sample261107-zyex4sft4x
SHA256 00438aee58f588a4b4199038020349da36a2b5def64041bad904454a3f5ea750
MD5 1636de733d71299400cc3f40adb3e479
SHA1 67531d41dce4cb12c3097db31d98b958bc8b9bf3
SHA512 119c2313cce6c8db1f00e38176ee302a4a42bf4eed9019ecdcac23484b70150a85bf8228939b4d0bd8f628906c6a8b777c3936049ab2ed9c20ad34184c9ac408
SSDEEP 3145728:3yuSLFnONAKNkCg2ak1fG7pQageZ6x1CYxc6Dqldijv:CusFGoLk3avZukYqdA
TLSH
T1D638339807AD045FDBA7C9F083A900689F30DA0BD7FD008A1A75F55CB3D6E4ABF29591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	NodeNet Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	NodeNet Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	NodeNet Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	NodeNet Launcher.exe

Executes dropped EXE 11 IoCs

pid	Process
4616	NodeNet Launcher.exe
1108	NodeNet Launcher.exe
2136	NodeNet Launcher.exe
3960	NodeNet Launcher.exe
1780	NodeNetLauncherSetup-1.0.25.exe
5392	old-uninstaller.exe
4832	NodeNet Launcher.exe
4600	NodeNet Launcher.exe
824	NodeNet Launcher.exe
3868	NodeNet Launcher.exe
964	NodeNet Launcher.exe

Loads dropped DLL 34 IoCs

pid	Process
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
3960	NodeNet Launcher.exe
1108	NodeNet Launcher.exe
1108	NodeNet Launcher.exe
1108	NodeNet Launcher.exe
1108	NodeNet Launcher.exe
1780	NodeNetLauncherSetup-1.0.25.exe
1780	NodeNetLauncherSetup-1.0.25.exe
1780	NodeNetLauncherSetup-1.0.25.exe
1780	NodeNetLauncherSetup-1.0.25.exe
1780	NodeNetLauncherSetup-1.0.25.exe
5392	old-uninstaller.exe
5392	old-uninstaller.exe
5392	old-uninstaller.exe
5392	old-uninstaller.exe
5392	old-uninstaller.exe
1780	NodeNetLauncherSetup-1.0.25.exe
824	NodeNet Launcher.exe
824	NodeNet Launcher.exe
824	NodeNet Launcher.exe
824	NodeNet Launcher.exe
3868	NodeNet Launcher.exe
964	NodeNet Launcher.exe
964	NodeNet Launcher.exe
964	NodeNet Launcher.exe
964	NodeNet Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
964	NodeNet Launcher.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5444	powershell.exe
5008	powershell.exe
1724	powershell.exe
3972	powershell.exe
4732	powershell.exe
4976	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4740	powershell.exe
3136	powershell.exe
2360	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NodeNetLauncherSetup-1.0.24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NodeNetLauncherSetup-1.0.25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	old-uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NodeNet Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NodeNet Launcher.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4740	powershell.exe
4740	powershell.exe
5444	powershell.exe
5444	powershell.exe
5892	NodeNetLauncherSetup-1.0.24.exe
5892	NodeNetLauncherSetup-1.0.24.exe
3972	powershell.exe
3972	powershell.exe
3136	powershell.exe
3136	powershell.exe
5008	powershell.exe
5008	powershell.exe
1780	NodeNetLauncherSetup-1.0.25.exe
1780	NodeNetLauncherSetup-1.0.25.exe
4732	powershell.exe
4732	powershell.exe
2360	powershell.exe
2360	powershell.exe
1724	powershell.exe
1724	powershell.exe
5392	old-uninstaller.exe
5392	old-uninstaller.exe
4976	powershell.exe
4976	powershell.exe
964	NodeNet Launcher.exe
964	NodeNet Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	5444	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeIncreaseQuotaPrivilege	3972	powershell.exe
Token: SeSecurityPrivilege	3972	powershell.exe
Token: SeTakeOwnershipPrivilege	3972	powershell.exe
Token: SeLoadDriverPrivilege	3972	powershell.exe
Token: SeSystemProfilePrivilege	3972	powershell.exe
Token: SeSystemtimePrivilege	3972	powershell.exe
Token: SeProfSingleProcessPrivilege	3972	powershell.exe
Token: SeIncBasePriorityPrivilege	3972	powershell.exe
Token: SeCreatePagefilePrivilege	3972	powershell.exe
Token: SeBackupPrivilege	3972	powershell.exe
Token: SeRestorePrivilege	3972	powershell.exe
Token: SeShutdownPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeSystemEnvironmentPrivilege	3972	powershell.exe
Token: SeRemoteShutdownPrivilege	3972	powershell.exe
Token: SeUndockPrivilege	3972	powershell.exe
Token: SeManageVolumePrivilege	3972	powershell.exe
Token: 33	3972	powershell.exe
Token: 34	3972	powershell.exe
Token: 35	3972	powershell.exe
Token: 36	3972	powershell.exe
Token: SeSecurityPrivilege	5892	NodeNetLauncherSetup-1.0.24.exe
Token: SeShutdownPrivilege	4616	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	4616	NodeNet Launcher.exe
Token: SeShutdownPrivilege	4616	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	4616	NodeNet Launcher.exe
Token: SeShutdownPrivilege	4616	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	4616	NodeNet Launcher.exe
Token: SeShutdownPrivilege	4616	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	4616	NodeNet Launcher.exe
Token: SeShutdownPrivilege	4616	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	4616	NodeNet Launcher.exe
Token: SeShutdownPrivilege	4616	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	4616	NodeNet Launcher.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeIncreaseQuotaPrivilege	4732	powershell.exe
Token: SeSecurityPrivilege	4732	powershell.exe
Token: SeTakeOwnershipPrivilege	4732	powershell.exe
Token: SeLoadDriverPrivilege	4732	powershell.exe
Token: SeSystemProfilePrivilege	4732	powershell.exe
Token: SeSystemtimePrivilege	4732	powershell.exe
Token: SeProfSingleProcessPrivilege	4732	powershell.exe
Token: SeIncBasePriorityPrivilege	4732	powershell.exe
Token: SeCreatePagefilePrivilege	4732	powershell.exe
Token: SeBackupPrivilege	4732	powershell.exe
Token: SeRestorePrivilege	4732	powershell.exe
Token: SeShutdownPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeSystemEnvironmentPrivilege	4732	powershell.exe
Token: SeRemoteShutdownPrivilege	4732	powershell.exe
Token: SeUndockPrivilege	4732	powershell.exe
Token: SeManageVolumePrivilege	4732	powershell.exe
Token: 33	4732	powershell.exe
Token: 34	4732	powershell.exe
Token: 35	4732	powershell.exe
Token: 36	4732	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 4740	5892	NodeNetLauncherSetup-1.0.24.exe	86
PID 5892 wrote to memory of 5444	5892	NodeNetLauncherSetup-1.0.24.exe	90
PID 5892 wrote to memory of 3972	5892	NodeNetLauncherSetup-1.0.24.exe	92
PID 4616 wrote to memory of 1108	4616	NodeNet Launcher.exe	106
PID 4616 wrote to memory of 2136	4616	NodeNet Launcher.exe	107
PID 4616 wrote to memory of 3960	4616	NodeNet Launcher.exe	108
PID 4616 wrote to memory of 1780	4616	NodeNet Launcher.exe	112
PID 1780 wrote to memory of 3136	1780	NodeNetLauncherSetup-1.0.25.exe	113
PID 1780 wrote to memory of 5008	1780	NodeNetLauncherSetup-1.0.25.exe	115
PID 1780 wrote to memory of 4732	1780	NodeNetLauncherSetup-1.0.25.exe	118
PID 1780 wrote to memory of 5392	1780	NodeNetLauncherSetup-1.0.25.exe	120
PID 5392 wrote to memory of 2360	5392	old-uninstaller.exe	121
PID 5392 wrote to memory of 1724	5392	old-uninstaller.exe	123
PID 5392 wrote to memory of 4976	5392	old-uninstaller.exe	125
PID 4832 wrote to memory of 4600	4832	NodeNet Launcher.exe	129
PID 4832 wrote to memory of 824	4832	NodeNet Launcher.exe	130
PID 4832 wrote to memory of 3868	4832	NodeNet Launcher.exe	131
PID 4832 wrote to memory of 964	4832	NodeNet Launcher.exe	133

C:\Users\Admin\AppData\Local\Temp\NodeNetLauncherSetup-1.0.24.exe
"C:\Users\Admin\AppData\Local\Temp\NodeNetLauncherSetup-1.0.24.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\nodenet-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972

C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1784,i,5117229100499351592,7081534949491789806,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,13525909997191398314,14265611253589188494,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1108
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --field-trial-handle=1784,i,5117229100499351592,7081534949491789806,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,13525909997191398314,14265611253589188494,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2136
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1784,i,5117229100499351592,7081534949491789806,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,13525909997191398314,14265611253589188494,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3960
- C:\Users\Admin\AppData\Local\nodenet-launcher-updater\pending\NodeNetLauncherSetup-1.0.25.exe
  C:\Users\Admin\AppData\Local\nodenet-launcher-updater\pending\NodeNetLauncherSetup-1.0.25.exe --updated /S --force-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\nodenet-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- - C:\Users\Admin\AppData\Local\Temp\nsb5EA2.tmp\old-uninstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nsb5EA2.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\nodenet-launcher
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2360
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1724
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\nodenet-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4976

C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --updated
1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --field-trial-handle=1844,i,16398315093858055704,15498757148320092784,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,8994533097297620824,13060523838951712908,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1960 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4600
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1844,i,16398315093858055704,15498757148320092784,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,8994533097297620824,13060523838951712908,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:824
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1844,i,16398315093858055704,15498757148320092784,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,8994533097297620824,13060523838951712908,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2540 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3868
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1844,i,16398315093858055704,15498757148320092784,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1848,i,8994533097297620824,13060523838951712908,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=884 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...