Loader.exetigerrat analysis report - Malicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

29.7sto launch

217telemetry events

63observed

26agent notes

Malicious

87/100

17 points past the malicious line at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+35

Malware family

Identified as Tiger RAT (possible confidence, named by static_yara)

+29

Static analysis

1 suspicious signature match(es)
3 high-risk capability bucket(s): Process injection, Ransomware behaviour, Anti-debugging

+23

Runtime behavior

2 living-off-the-land binary abuse(s)
1 Sigma rule match(es): System File Execution Location Anomaly

Model review

findings review (advisory, not scored): suspicious - process spawning, registry manipulation, anti-debug capability, unsigned binary

Model reading

Measured MALICIOUS87 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score

Dynamic ran moved the score

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution71s (ended early)

Guest hardware2 vCPU4095 MB RAM

Malware family

1 independent source

Tiger RAT possible

Named by a single source. Treat it as a lead rather than a classification.

Layer	Source	What it matched
static_yara	rule corpus	TigerRAT_pe_yaraify

Detection signatures

26 detected · 11 withheld as common

Severity	Detection	Evidence	Layer
HIGH	Creates a thread in a remote process MITRE T1055.002	import kernel32.dll!CreateRemoteThread	static
MED	Creates a suspended process then resumes (hollowing/hijack) MITRE T1055.012	import kernel32.dll!CreateProcessW requires createprocess import kernel32.dll!ResumeThread requires resumethread	static
MED	Decrypts data at runtime (CryptDecrypt) MITRE T1140	import advapi32.dll!CryptDecrypt	static
MED	Exception-based anti-debug (SEH/VEH install) MITRE T1622	import kernel32.dll!AddVectoredExceptionHandler	static
MED	LOLBin abuse: cmd chained command execution MITRE T1059.003	command cmd observed command line	dynamic
MED	Opens/suspends remote threads MITRE T1055	import kernel32.dll!OpenThread requires openthread import kernel32.dll!SuspendThread requires suspendthread	static
MED	Raw socket networking MITRE T1095	import ws2_32.dll!WSAStartup	static
MED	TLS callback (pre-main execution) MITRE T1055	pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point	static
LOW	Checks free disk space (sandbox sizing check) MITRE T1497.001 seen in 6% of benign software	import kernel32.dll!GetDiskFreeSpaceW	static
LOW	Checks parent process (sandbox parent detection) MITRE T1497	import kernel32.dll!Process32Next requires process32next import kernel32.dll!GetCurrentProcessId requires getcurrentprocessid	static
LOW	Cryptographic capability (packing/ransom) MITRE T1573 seen in 6% of benign software	capability bcryptgenrandom capability: crypto capability cryptacquirecontextw capability: crypto capability cryptdecrypt capability: crypto	static
LOW	Deletes files/backups (WriteFile + DeleteFile recursion) MITRE T1485 seen in 14% of benign software	import kernel32.dll!DeleteFileA requires deletefile import kernel32.dll!FindNextFileW requires findnextfile	static
LOW	Direct memory execution (VirtualProtect + memory copy) MITRE T1055 seen in 9% of benign software	import kernel32.dll!VirtualProtect requires virtualprotect import kernel32.dll!VirtualAlloc requires virtualalloc	static
LOW	Driver communication via DeviceIoControl MITRE T1068 seen in 10% of benign software	import kernel32.dll!DeviceIoControl	static
LOW	Drops + executes from temp (GetTempPath + CreateProcess) MITRE T1204 seen in 7% of benign software	import kernel32.dll!GetTempPathA requires gettemppath import kernel32.dll!CreateProcessW requires createprocess	static
LOW	Duplicates a process handle (handle theft) MITRE T1134 seen in 10% of benign software	import kernel32.dll!DuplicateHandle	static
LOW	Enumerates running processes MITRE T1057	import kernel32.dll!CreateToolhelp32Snapshot	static
LOW	Hypervisor/CPUID-style environment check MITRE T1497.001 seen in 7% of benign software	import kernel32.dll!GetNativeSystemInfo	static
LOW	Marks files hidden/system (SetFileAttributes) MITRE T1564.001 seen in 10% of benign software	import kernel32.dll!SetFileAttributesW	static
LOW	Network communication capability MITRE T1071 seen in 6% of benign software	capability bind capability: network capability connect capability: network capability gethostbyname capability: network capability recv capability: network capability send capability: network capability socket capability: network	static
LOW	Process-injection capability MITRE T1055 seen in 5% of benign software	capability createremotethread capability: injection capability getthreadcontext capability: injection	static
LOW	Reflective/manual DLL load pattern MITRE T1620 seen in 8% of benign software	import kernel32.dll!VirtualAlloc requires virtualalloc import kernel32.dll!GetProcAddress requires getprocaddress import kernel32.dll!LoadLibraryA requires loadlibrary import kernel32.dll!CreateThread requires createthread	static
LOW	Self-deletion pattern (MoveFileEx) MITRE T1070.004 seen in 7% of benign software	import kernel32.dll!MoveFileExW	static
LOW	Spawns child processes MITRE T1106 seen in 16% of benign software	import kernel32.dll!CreateProcessW	static
LOW	Timestomping (SetFileTime) MITRE T1070.006 seen in 6% of benign software	import kernel32.dll!SetFileTime	static
INFO	Stages in the temp directory (GetTempPath) MITRE T1074 seen in 15% of benign software	import kernel32.dll!GetTempPathA	static

Withheld: 11 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software

Anti-debugging capability fires on 65% of benign software

Dynamic API resolution (obfuscation) fires on 65% of benign software

Anti-debug: checks for a debugger fires on 60% of benign software

Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software

Anti-debug via OutputDebugString probe fires on 41% of benign software

Reads its own startup info (parent/desktop check) fires on 36% of benign software

Executes external code / commands fires on 30% of benign software

Queries system information (host recon) fires on 25% of benign software

Enumerates registry keys (discovery) fires on 21% of benign software

Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	not tested - the autostart surfaces were snapshotted before the sample ran, but this run left no record of the comparison afterwards, so an empty result cannot be read as a clean one
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - internet was disabled
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Capability analysis of the file's code	not checked - the check ran past its time limit and was stopped
Anti-analysis / evasion checks	not measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Observed. Observed at runtime and attributed to this sample by one layer. The one fact that decided it: behavioural rule matched.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

nexe

Packed: nexe Unsigned

CompilerMicrosoft Visual C/C++(19.36.34433)[LTCG/C++]

LinkerMicrosoft Linker(14.36.34433)

Identity

File

typeexecutable

size59.9 MB

file arch64-bit (x64)

subsystemGUI

entropy6.5982

date2025-05-03 21:26:46 UTC

version1.5.0.237

descriptionGachimuchi Power Launcher

productGachiLauncher

original namegachilauncher.exe

languageEN, NEU

Antivirus engine

no signature matched

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

This run did not record which signature set answered, so the result above cannot be tied to a named set or reproduced against one. Recording the set began part way through this platform's history, and this scan predates it.

Local ML assessment

no model score

This scan ran before the local classifier was installed on this host, so no model score was produced for it. Submitting the same file again produces one.

Structural rules of thumb, not a model. 2 cheap static signals fired, for 15 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

unsigned executable
TLS callback

Packing

Not packed

This file's code is readable on disk - nothing is compressed or encrypted around it.

8/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed 1 signal

TLS callback present

Capabilities

11 behaviour buckets · 5 high-risk

Severity	Capability	MITRE	APIs
high	Process injection Writes and runs code inside another process	T1055, T1055.012	createremotethread, getthreadcontext
high	Ransomware behaviour Enumerates + encrypts files, deletes backups	T1083	findfirstfilew, findnextfilew
high	Anti-debugging Detects or obstructs a debugger	T1622	isdebuggerpresent, outputdebugstringa
high	Privilege escalation Adjusts tokens / privileges	T1134	openprocesstoken
high	Defense evasion Tampers with security tooling / hides artifacts	T1070.004	deletefilea
med	Network / C2 Opens sockets, HTTP or downloads payloads	T1071, T1095, T1590	bind, connect, gethostbyname, recv, send, socket, wsastartup
med	Evasion / stalling Sleeps, times, or otherwise stalls analysis	T1497, T1497.003	getsystemtimeasfiletime, gettickcount, queryperformancecounter, sleep
med	Dynamic API resolution Resolves APIs at runtime (obfuscation)	T1129	getprocaddress, loadlibrarya, loadlibraryw
med	Cryptography Uses crypto APIs (often ransomware / packers)	T1486, T1573	bcryptgenrandom, cryptacquirecontextw, cryptdecrypt
med	Code execution Creates processes / runs commands or shellcode	T1106	createprocessw, createthread
low	Discovery Enumerates the host, users, processes or network	T1033, T1057, T1082	createtoolhelp32snapshot, enumprocessmodules, getnativesysteminfo, getsysteminfo, getusernamew, getversionexa, process32first, pr…

Security mitigations

partial posture

ON ASLR (DynamicBase)

ON High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

OFF Control Flow Guard

OFF SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Rich header (toolchain)

richhash 63a416fc724e95e3

Tool	Build	Uses
Utc1900 (VS2017)	30795	23
Export 14.10	30795	209
Cvtres 14.10	30795	46
prodid_253	34321	10
Cvtres 14.10	34321	19
Utc1900 (VS2017)	34321	12
Export 14.10	34321	100
Unknown	0	30
Utc1900 (VS2017)	34433	2
Export 14.10	34433	1396
Cvtres 14.10	34433	861
Utc1900 (VS2017)	30795	23
Import (linker)	0	400
prodid_265	34433	4
Alias	34433	1
Implib	34433	1
prodid_151	0	2
AliasObj 14.10	34433	1

Sections

6 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.textEP Executable code	0x1000	17.1 MB	17.1 MB	EXECUTEREAD	6.4668
.rdata Read-only data	0x111c000	41.3 MB	41.3 MB	READ	6.3059
.data Initialised data	0x3a67000	183.0 KB	2.8 MB expands	READWRITE	3.53
.pdata Exception unwind data	0x3d40000	839.5 KB	839.4 KB	READ	6.8161
.rsrc Resources	0x3e12000	53.5 KB	53.1 KB	READ	3.9694
.reloc Base relocations	0x3e20000	114.0 KB	113.8 KB	READ	5.4817

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

376 funcs / 11 DLLs · 24 suspicious

▸dbghelp.dll11 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
SymSetSearchPathW	0x0111cbb8	-	-
SymGetSearchPathW	0x0111cbc0	-	-
SymGetModuleBase64	0x0111cbc8	-	-
SymFunctionTableAccess64	0x0111cbd0	-	-
StackWalk64	0x0111cbd8	-	-
SymSetOptions	0x0111cbe0	-	-
SymFromAddr	0x0111cbe8	-	-
SymInitialize	0x0111cbf0	-	-
SymGetLineFromAddr64	0x0111cbf8	-	-
SymCleanup	0x0111cc00	-	-
UnDecorateSymbolName	0x0111cc08	-	-

▸WS2_32.dll42 funcs 4 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
htonl	0x0111ca50	-	-
ntohl	0x0111ca58	-	-
closesocket	0x0111ca60	-	-
getsockopt	0x0111ca68	-	-
WSAStartup	0x0111ca70	-	T1071
send	0x0111ca78	-	T1071
ntohs	0x0111ca80	-	-
gethostname	0x0111ca88	-	-
__WSAFDIsSet	0x0111ca90	-	-
WSASetLastError	0x0111ca98	-	-
getnameinfo	0x0111caa0	-	-
freeaddrinfo	0x0111caa8	-	-
getaddrinfo	0x0111cab0	-	-
WSACleanup	0x0111cab8	-	-
gethostbyname	0x0111cac0	-	-
accept	0x0111cac8	-	-
sendto	0x0111cad0	-	-
recvfrom	0x0111cad8	-	-
WSAIoctl	0x0111cae0	-	-
recv	0x0111cae8	-	-
FreeAddrInfoW	0x0111caf0	-	-
GetAddrInfoW	0x0111caf8	-	-
GetNameInfoW	0x0111cb00	-	-
select	0x0111cb08	-	-
WSASocketW	0x0111cb10	-	-
WSASend	0x0111cb18	-	-
WSAGetOverlappedResult	0x0111cb20	-	-
WSADuplicateSocketW	0x0111cb28	-	-
shutdown	0x0111cb30	-	-
listen	0x0111cb38	-	-
htons	0x0111cb40	-	-
WSASendTo	0x0111cb48	-	-
WSARecvFrom	0x0111cb50	-	-
WSARecv	0x0111cb58	-	-
setsockopt	0x0111cb60	-	-
getsockname	0x0111cb68	-	-
getpeername	0x0111cb70	-	-
ioctlsocket	0x0111cb78	-	-
connect	0x0111cb80	-	T1071
bind	0x0111cb88	-	-
WSAGetLastError	0x0111cb90	-	-
socket	0x0111cb98	-	T1071

▸IPHLPAPI.DLL4 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetBestRoute2	0x0111c160	-	-
GetAdaptersAddresses	0x0111c168	-	-
ConvertInterfaceLuidToNameW	0x0111c170	-	-
ConvertInterfaceIndexToLuid	0x0111c178	-	-

▸PSAPI.DLL3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetModuleFileNameExW	0x0111c9c8	-	-
GetProcessMemoryInfo	0x0111c9d0	-	-
EnumProcessModules	0x0111c9d8	-	-

▸USERENV.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetUserProfileDirectoryW	0x0111ca30	-	-

▸ADVAPI32.dll35 funcs 3 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CryptSetHashParam	0x0111c000	-	-
RegEnumKeyExA	0x0111c008	-	-
RegOpenKeyExA	0x0111c010	-	-
RegQueryValueExA	0x0111c018	-	-
RegEnumKeyExW	0x0111c020	-	-
RegQueryInfoKeyW	0x0111c028	-	-
OpenProcessToken	0x0111c030	-	T1134
GetUserNameW	0x0111c038	-	-
EventWriteTransfer	0x0111c040	-	-
EventUnregister	0x0111c048	-	-
EventRegister	0x0111c050	-	-
ReportEventW	0x0111c058	-	-
RegisterEventSourceW	0x0111c060	-	-
DeregisterEventSource	0x0111c068	-	-
CryptEnumProvidersW	0x0111c070	-	-
CryptSignHashW	0x0111c078	-	-
CryptDestroyHash	0x0111c080	-	-
CryptCreateHash	0x0111c088	-	-
CryptDecrypt	0x0111c090	-	T1486
CryptExportKey	0x0111c098	-	-
CryptGetUserKey	0x0111c0a0	-	-
CryptGetProvParam	0x0111c0a8	-	-
CryptDestroyKey	0x0111c0b0	-	-
CryptReleaseContext	0x0111c0b8	-	-
CryptAcquireContextW	0x0111c0c0	-	T1486
SetSecurityInfo	0x0111c0c8	-	-
GetSecurityInfo	0x0111c0d0	-	-
SetEntriesInAclA	0x0111c0d8	-	-
FreeSid	0x0111c0e0	-	-
AllocateAndInitializeSid	0x0111c0e8	-	-
SystemFunction036	0x0111c0f0	-	-
RegGetValueW	0x0111c0f8	-	-
RegQueryValueExW	0x0111c100	-	-
RegOpenKeyExW	0x0111c108	-	-
RegCloseKey	0x0111c110	-	-

▸USER32.dll8 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetUserObjectInformationW	0x0111c9e8	-	-
DispatchMessageA	0x0111c9f0	-	-
TranslateMessage	0x0111c9f8	-	-
GetMessageA	0x0111ca00	-	-
GetSystemMetrics	0x0111ca08	-	-
MessageBoxW	0x0111ca10	-	-
MapVirtualKeyW	0x0111ca18	-	-
GetProcessWindowStation	0x0111ca20	-	-

▸CRYPT32.dll7 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CertOpenStore	0x0111c120	-	-
CertFreeCertificateContext	0x0111c128	-	-
CertCloseStore	0x0111c130	-	-
CertEnumCertificatesInStore	0x0111c138	-	-
CertFindCertificateInStore	0x0111c140	-	-
CertDuplicateCertificateContext	0x0111c148	-	-
CertGetCertificateContextProperty	0x0111c150	-	-

▸bcrypt.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
BCryptGenRandom	0x0111cba8	-	-

▸KERNEL32.dll263 funcs 17 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
InterlockedPushEntrySList	0x0111c188	-	-
IsProcessorFeaturePresent	0x0111c190	-	-
UnhandledExceptionFilter	0x0111c198	-	-
RtlLookupFunctionEntry	0x0111c1a0	yes	-
RtlCaptureContext	0x0111c1a8	yes	-
GetCPInfo	0x0111c1b0	-	-
RtlUnwindEx	0x0111c1b8	yes	-
RtlPcToFileHeader	0x0111c1c0	yes	-
RaiseException	0x0111c1c8	-	-
ExitProcess	0x0111c1d0	-	-
SetStdHandle	0x0111c1d8	-	-
CreateThread	0x0111c1e0	-	-
ExitThread	0x0111c1e8	-	-
FreeLibraryAndExitThread	0x0111c1f0	-	-
GetFileAttributesExW	0x0111c1f8	-	-
SetFileAttributesW	0x0111c200	-	-
GetConsoleOutputCP	0x0111c208	-	-
GetDriveTypeW	0x0111c210	-	-
GetCommandLineA	0x0111c218	-	-
GetCommandLineW	0x0111c220	-	-
HeapFree	0x0111c228	-	-
HeapAlloc	0x0111c230	-	-
FlsAlloc	0x0111c238	-	-
FlsGetValue	0x0111c240	-	-
FlsSetValue	0x0111c248	-	-
FlsFree	0x0111c250	-	-
CompareStringW	0x0111c258	-	-
GetLocaleInfoW	0x0111c260	-	-
IsValidLocale	0x0111c268	-	-
GetUserDefaultLCID	0x0111c270	-	-
EnumSystemLocalesW	0x0111c278	-	-
OutputDebugStringW	0x0111c280	-	T1622
HeapReAlloc	0x0111c288	-	-
SetEndOfFile	0x0111c290	-	-
GetStringTypeW	0x0111c298	-	-
HeapSize	0x0111c2a0	-	-
FindFirstFileExW	0x0111c2a8	-	-
IsValidCodePage	0x0111c2b0	-	-
GetOEMCP	0x0111c2b8	-	-
GetProcessHeap	0x0111c2c0	-	-
InitializeSListHead	0x0111c2c8	-	-
CreateJobObjectW	0x0111c2d0	-	-
VerSetConditionMask	0x0111c2d8	-	-
VerifyVersionInfoW	0x0111c2e0	-	-
GetEnvironmentVariableA	0x0111c2e8	-	-
WideCharToMultiByte	0x0111c2f0	-	-
FreeLibrary	0x0111c2f8	-	-
GetProcAddress	0x0111c300	-	T1129
LoadLibraryW	0x0111c308	-	T1129
MultiByteToWideChar	0x0111c310	-	-
CloseHandle	0x0111c318	-	-
CreateFileMappingW	0x0111c320	-	-
MapViewOfFile	0x0111c328	-	-
UnmapViewOfFile	0x0111c330	-	-
GetLocalTime	0x0111c338	-	-
SetConsoleCtrlHandler	0x0111c340	-	-
GetLastError	0x0111c348	-	-
WaitForSingleObject	0x0111c350	-	-
CreateRemoteThread	0x0111c358	-	T1055
OpenProcess	0x0111c360	-	-
OpenFileMappingW	0x0111c368	-	-
GetFileType	0x0111c370	-	-
RemoveVectoredExceptionHandler	0x0111c378	-	-
RtlCaptureStackBackTrace	0x0111c380	yes	-
GetStdHandle	0x0111c388	-	-
GetCurrentProcess	0x0111c390	-	-
GetCurrentProcessId	0x0111c398	-	-
VirtualQuery	0x0111c3a0	-	-
WriteConsoleW	0x0111c3a8	-	-
LocalFree	0x0111c3b0	-	-
FormatMessageA	0x0111c3b8	-	-
InitOnceExecuteOnce	0x0111c3c0	-	-
CreateEventA	0x0111c3c8	-	-
GetModuleHandleA	0x0111c3d0	-	-
LoadLibraryA	0x0111c3d8	-	T1129
GetEnvironmentStringsW	0x0111c3e0	-	-
FreeEnvironmentStringsW	0x0111c3e8	-	-
GetEnvironmentVariableW	0x0111c3f0	-	-
SetEnvironmentVariableW	0x0111c3f8	-	-
SetCurrentDirectoryW	0x0111c400	-	-
GetCurrentDirectoryW	0x0111c408	-	-
GetTempPathW	0x0111c410	-	-
SetLastError	0x0111c418	-	-
QueryPerformanceCounter	0x0111c420	-	T1497
QueryPerformanceFrequency	0x0111c428	-	-
InitializeCriticalSection	0x0111c430	-	-
EnterCriticalSection	0x0111c438	-	-
LeaveCriticalSection	0x0111c440	-	-
Sleep	0x0111c448	-	-
GetProcessTimes	0x0111c450	-	-
SetPriorityClass	0x0111c458	-	-
GetPriorityClass	0x0111c460	-	-
GlobalMemoryStatusEx	0x0111c468	-	-
GetSystemInfo	0x0111c470	-	-
GetSystemTimeAsFileTime	0x0111c478	-	-
GetVersionExW	0x0111c480	-	-
GetModuleFileNameW	0x0111c488	-	-
GetProcessIoCounters	0x0111c490	-	-
VerifyVersionInfoA	0x0111c498	-	-
FileTimeToSystemTime	0x0111c4a0	-	-
GetConsoleTitleW	0x0111c4a8	-	-
SetConsoleTitleW	0x0111c4b0	-	-
CreateToolhelp32Snapshot	0x0111c4b8	-	T1057
Process32First	0x0111c4c0	-	T1057
Process32Next	0x0111c4c8	-	T1057
SetHandleInformation	0x0111c4d0	-	-
CreateIoCompletionPort	0x0111c4d8	-	-
SetFileCompletionNotificationModes	0x0111c4e0	-	-
CreateFileA	0x0111c4e8	-	-
CreateFileW	0x0111c4f0	-	-
DuplicateHandle	0x0111c4f8	-	-
PostQueuedCompletionStatus	0x0111c500	-	-
SetEvent	0x0111c508	-	-
ResetEvent	0x0111c510	-	-
QueueUserWorkItem	0x0111c518	-	-
RegisterWaitForSingleObject	0x0111c520	-	-
UnregisterWait	0x0111c528	-	-
GetConsoleMode	0x0111c530	-	-
SetConsoleMode	0x0111c538	-	-
GetNumberOfConsoleInputEvents	0x0111c540	-	-
ReadConsoleInputW	0x0111c548	-	-
ReadConsoleW	0x0111c550	-	-
FillConsoleOutputCharacterW	0x0111c558	-	-
FillConsoleOutputAttribute	0x0111c560	-	-
GetConsoleCursorInfo	0x0111c568	-	-
SetConsoleCursorInfo	0x0111c570	-	-
GetConsoleScreenBufferInfo	0x0111c578	-	-
SetConsoleCursorPosition	0x0111c580	-	-
SetConsoleTextAttribute	0x0111c588	-	-
WriteConsoleInputW	0x0111c590	-	-
CancelIoEx	0x0111c598	-	-
CancelIo	0x0111c5a0	-	-
SwitchToThread	0x0111c5a8	-	-
GetStartupInfoW	0x0111c5b0	-	-
GetFileAttributesW	0x0111c5b8	-	-
TerminateProcess	0x0111c5c0	-	-
GetExitCodeProcess	0x0111c5c8	-	-
CreateProcessW	0x0111c5d0	-	T1106
UnregisterWaitEx	0x0111c5d8	-	-
RtlUnwind	0x0111c5e0	yes	-
AssignProcessToJobObject	0x0111c5e8	-	-
SetInformationJobObject	0x0111c5f0	-	-
LCMapStringW	0x0111c5f8	-	-
TryEnterCriticalSection	0x0111c600	-	-
DeleteCriticalSection	0x0111c608	-	-
InitializeConditionVariable	0x0111c610	-	-
WakeConditionVariable	0x0111c618	-	-
WakeAllConditionVariable	0x0111c620	-	-
SleepConditionVariableCS	0x0111c628	-	-
ReleaseSemaphore	0x0111c630	-	-
CreateSemaphoreW	0x0111c638	-	-
GetCurrentThread	0x0111c640	-	-
ResumeThread	0x0111c648	-	-
TlsAlloc	0x0111c650	-	-
TlsGetValue	0x0111c658	-	-
TlsSetValue	0x0111c660	-	-
TlsFree	0x0111c668	-	-
GetNativeSystemInfo	0x0111c670	-	-
CreateSemaphoreA	0x0111c678	-	-
FlushFileBuffers	0x0111c680	-	-
ReadFile	0x0111c688	-	-
WriteFile	0x0111c690	-	-
ConnectNamedPipe	0x0111c698	-	-
SetNamedPipeHandleState	0x0111c6a0	-	-
PeekNamedPipe	0x0111c6a8	-	-
CreateNamedPipeW	0x0111c6b0	-	-
WaitNamedPipeW	0x0111c6b8	-	-
CancelSynchronousIo	0x0111c6c0	-	-
CreateNamedPipeA	0x0111c6c8	-	-
GetNamedPipeHandleStateA	0x0111c6d0	-	-
GetLongPathNameW	0x0111c6d8	-	-
GetShortPathNameW	0x0111c6e0	-	-
ReadDirectoryChangesW	0x0111c6e8	-	-
CreateDirectoryW	0x0111c6f0	-	-
FindClose	0x0111c6f8	-	-
FindFirstFileW	0x0111c700	-	T1083
FindNextFileW	0x0111c708	-	T1083
GetDiskFreeSpaceW	0x0111c710	-	-
GetFileInformationByHandle	0x0111c718	-	-
GetFileSizeEx	0x0111c720	-	-
GetFinalPathNameByHandleW	0x0111c728	-	-
GetFullPathNameW	0x0111c730	-	-
RemoveDirectoryW	0x0111c738	-	-
SetFilePointerEx	0x0111c740	-	-
SetFileTime	0x0111c748	-	-
DeviceIoControl	0x0111c750	-	-
FlushViewOfFile	0x0111c758	-	-
CreateFileMappingA	0x0111c760	-	-
ReOpenFile	0x0111c768	-	-
CopyFileW	0x0111c770	-	-
MoveFileExW	0x0111c778	-	-
CreateHardLinkW	0x0111c780	-	-
GetFileInformationByHandleEx	0x0111c788	-	-
CreateSymbolicLinkW	0x0111c790	-	-
DebugBreak	0x0111c798	-	-
LoadLibraryExW	0x0111c7a0	-	-
SetErrorMode	0x0111c7a8	-	-
GetQueuedCompletionStatus	0x0111c7b0	-	-
ReadConsoleA	0x0111c7b8	-	-
InitializeCriticalSectionAndSpinCount	0x0111c7c0	-	-
GetCurrentThreadId	0x0111c7c8	-	-
GetModuleHandleW	0x0111c7d0	-	-
GetSystemTime	0x0111c7d8	-	-
SystemTimeToFileTime	0x0111c7e0	-	-
FormatMessageW	0x0111c7e8	-	-
SwitchToFiber	0x0111c7f0	-	-
DeleteFiber	0x0111c7f8	-	-
CreateFiber	0x0111c800	-	-
ConvertFiberToThread	0x0111c808	-	-
ConvertThreadToFiber	0x0111c810	-	-
RtlVirtualUnwind	0x0111c818	yes	-
GetModuleHandleExW	0x0111c820	-	-
AddVectoredExceptionHandler	0x0111c828	-	-
RtlAddFunctionTable	0x0111c830	yes	-
RtlDeleteFunctionTable	0x0111c838	yes	-
VirtualProtect	0x0111c840	-	T1055
IsDebuggerPresent	0x0111c848	-	T1622
OutputDebugStringA	0x0111c850	-	T1622
OpenThread	0x0111c858	-	-
SuspendThread	0x0111c860	-	-
GetThreadContext	0x0111c868	-	-
GetLocaleInfoEx	0x0111c870	-	-
GetNumberFormatEx	0x0111c878	-	-
GetCurrencyFormatEx	0x0111c880	-	-
ResolveLocaleName	0x0111c888	-	-
SystemTimeToTzSpecificLocalTime	0x0111c890	-	-
GetTimeZoneInformation	0x0111c898	-	-
GetTimeFormatEx	0x0111c8a0	-	-
GetDateFormatEx	0x0111c8a8	-	-
ExpandEnvironmentStringsA	0x0111c8b0	-	-
GetWindowsDirectoryA	0x0111c8b8	-	-
GetVersionExA	0x0111c8c0	-	-
GetTickCount	0x0111c8c8	-	T1497
GetACP	0x0111c8d0	-	-
GetDynamicTimeZoneInformation	0x0111c8d8	-	-
GetGeoInfoW	0x0111c8e0	-	-
GetUserGeoID	0x0111c8e8	-	-
LocaleNameToLCID	0x0111c8f0	-	-
LCIDToLocaleName	0x0111c8f8	-	-
ReleaseSRWLockExclusive	0x0111c900	-	-
ReleaseSRWLockShared	0x0111c908	-	-
AcquireSRWLockExclusive	0x0111c910	-	-
AcquireSRWLockShared	0x0111c918	-	-
TryAcquireSRWLockExclusive	0x0111c920	-	-
TryAcquireSRWLockShared	0x0111c928	-	-
DeleteFileA	0x0111c930	-	-
GetFileSize	0x0111c938	-	-
GetTempPathA	0x0111c940	-	-
GetTempFileNameA	0x0111c948	-	-
GetThreadTimes	0x0111c950	-	-
VirtualAlloc	0x0111c958	-	T1055
VirtualFree	0x0111c960	-	-
SetThreadPriority	0x0111c968	-	-
GetThreadPriority	0x0111c970	-	-
QueryThreadCycleTime	0x0111c978	-	-
SleepConditionVariableSRW	0x0111c980	-	-
SetUnhandledExceptionFilter	0x0111c988	-	-
InitOnceBeginInitialize	0x0111c990	-	-
InitOnceComplete	0x0111c998	-	-
InitializeCriticalSectionEx	0x0111c9a0	-	-
EncodePointer	0x0111c9a8	-	-
DecodePointer	0x0111c9b0	-	-
LCMapStringEx	0x0111c9b8	-	-

▸WINMM.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
timeGetTime	0x0111ca40	-	-

Binary metadata

what the headers declare about this build

Resource langs	ENNEU
Debug info	yes
TLS callbacks	yes

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Resources

Resource Hacker view

Group Icon1Icon8Manifest1Message Table1Version Info1WEVT_TEMPLATE1

▸Group Icon1

ICONNEU

▸Icon8

1NEU

2NEU

3NEU

4NEU

5NEU

6NEU

7NEU

8NEU

▸Manifest1

1EN

▸Message Table1

1EN

▸Version Info1

1EN

▸WEVT_TEMPLATE1

1EN

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Group Icon ICON Download

Type	Group Icon
Name / ID	ICON
Language	NEU
Size	118.0 B
RVA offset	0x3e1edd4
Content signature	Icon
MD5	1cab4d110c720a63bd3c8e5cc61912b8
Entropy	2.935

Icon 1 Download

Type	Icon
Name / ID	1
Language	NEU
Size	2.2 KB
RVA offset	0x3e1387c
Content signature	PNG
MD5	2461403b766c8c5bf0dc93cca47061f0
Entropy	7.408

Icon 2 Download

Type	Icon
Name / ID	2
Language	NEU
Size	16.5 KB
RVA offset	0x3e14158
Content signature	Icon
MD5	f92fcbff55e52b43dbc7075ce1de9cca
Entropy	3.208

Icon 3 Download

Type	Icon
Name / ID	3
Language	NEU
Size	9.4 KB
RVA offset	0x3e18380
Content signature	Icon
MD5	fece3cce5fa13fe84af09cd1fafbd2b9
Entropy	3.19

Icon 4 Download

Type	Icon
Name / ID	4
Language	NEU
Size	6.6 KB
RVA offset	0x3e1a928
Content signature	Icon
MD5	e46710bc38bb2a8d1e782636bac20e01
Entropy	3.423

Icon 5 Download

Type	Icon
Name / ID	5
Language	NEU
Size	4.2 KB
RVA offset	0x3e1c390
Content signature	Icon
MD5	27cd4ca738a91819f9f636be494507a2
Entropy	3.171

Icon 6 Download

Type	Icon
Name / ID	6
Language	NEU
Size	2.4 KB
RVA offset	0x3e1d438
Content signature	Icon
MD5	cf37f9049299557730ab4fb99da0ebec
Entropy	3.391

Icon 7 Download

Type	Icon
Name / ID	7
Language	NEU
Size	1.7 KB
RVA offset	0x3e1ddc0
Content signature	Icon
MD5	17818cee27c89afbdc62cb905ffa6de8
Entropy	3.346

Icon 8 Download

Type	Icon
Name / ID	8
Language	NEU
Size	1.1 KB
RVA offset	0x3e1e478
Content signature	Icon
MD5	51cc02b8709b1d718d1e1e5efd71cbe1
Entropy	2.996

Manifest 1 Download

Type	Manifest
Name / ID	1
Language	EN
Size	822.0 B
RVA offset	0x3e1f158
Content signature	XML manifest
MD5	556b1d9ae9f7ded1145da7d1e7fe470f
Entropy	5.33

Application manifest

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS></application></compatibility></assembly>

Message Table 1 Download

Type	Message Table
Name / ID	1
Language	EN
Size	1.2 KB
RVA offset	0x3e1e8e0
Content signature	Message Table
MD5	eb58d473c31183f2e939d04d6b24229d
Entropy	3.441

Version Info 1 Download

Type	Version Info
Name / ID	1
Language	EN
Size	780.0 B
RVA offset	0x3e1ee4c
Content signature	Version Info
MD5	dfe9f053641d43c04d63dffe8002ca2a
Entropy	3.554

Parsed version info

CompanyName	GachiCorp
FileVersion	1.5.0.237
ProductName	GachiLauncher
InternalName	GachiLauncher
LegalCopyright	Â© 2025 GachiCorp. ÐÑÐµ Ð¿ÑÐ°Ð²Ð° Ð·Ð°ÑÐ¸ÑÐµÐ½Ñ.
ProductVersion	1.5.0.237
FileDescription	Gachimuchi Power Launcher
OriginalFilename	gachilauncher.exe

WEVT_TEMPLATE 1

Type	WEVT_TEMPLATE
Name / ID	1
Language	EN
Size	5.3 KB
RVA offset	0x3e12338
Content signature	WEVT_TEMPLATE
MD5	806dda65d5780160430d24f2f41d5fe2
Entropy	3.674

Threat classification

Signature family candidates

Family	Agreeing rules	Matched rules	Disposition
Tiger RAT	1	TigerRAT_pe_yaraify	Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.

Capability detection

not completed

The capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.

Signature matches

9 findings · 5 file properties · 1 scored

Rule	What it matched	Corpus	Weight
Suspicious_Anti_Debug_API	Anti-debugging API names referenced 3 of 4 strings matched $a IsDebuggerPresent at 0x3a64956 $c NtQueryInformationProcess at 0x1628cb8 $d OutputDebugString at 0x3a6496a · 2 hits	Built-in ruleset this platform ships, and the only one the score reads	SCORED 5 Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
TigerRAT_pe_yaraify rule dated 2026-08-21	YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits 1 of 1 string matched $c0 \x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed at 0x10da4ce · 2 hits	Tier 1 - curated family set licence-gated and benign-tested; may name a malware family	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it. Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
Email_Generic_Phishing email	No description 15 of 19 strings matched $eml_1 From: at 0x11ffc31 $eml_2 To: at 0x11ffc52 · 2 hits $eml_3 Subject: at 0x162dab2 · 2 hits $greeting_2 attention at 0x17e1c2c · 3 hits $url_1 Click at 0x17d8152 · 14 hits $url_2 Confirm at 0x16573f6 · 5 hits $url_3 Verify at 0x11444fb · 402 hits $url_4 here at 0x111d12b · 568 hits and 7 more	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
without_attachments mail	Rule to detect the no presence of any attachment 3 of 5 strings matched $eml_01 From: at 0x11ffc31 $eml_02 To: at 0x11ffc52 · 2 hits $eml_03 Subject: at 0x162dab2 · 2 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
with_images mail	Rule to detect the presence of an or several images 5 of 6 strings matched $eml_01 From: at 0x11ffc31 $eml_02 To: at 0x11ffc52 · 2 hits $eml_03 Subject: at 0x162dab2 · 2 hits $img_a .jpg at 0x17d71dc · 15 hits $img_b .png at 0x17d706c · 8 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
maldoc_indirect_function_call_3 maldoc	No description 1 of 1 string matched $a \xff\xb7\xffW\xffW\xffW\xff at 0x2f290e3	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
maldoc_getEIP_method_1 maldoc	No description 1 of 1 string matched $a \xe8\x00\x00\x00\x00] at 0x2636629	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
possible_includes_base64_packed_functions	Detects possible includes and packed functions 2 of 2 strings matched $f base64, at 0x115a6a1 · 22 hits $fff This at 0x4e · 1000000 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
with_urls mail	Rule to detect the presence of an or several urls 4 of 4 strings matched $eml_01 From: at 0x11ffc31 $eml_02 To: at 0x11ffc52 · 2 hits $eml_03 Subject: at 0x162dab2 · 2 hits $url_regex https://github.com/nodejs/node/p... at 0x112339d · 473 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.

File properties - not findings

IsPE64IsWindowsGUIHasOverlayHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

Extracted strings

showing 200 of 232

!This program cannot be run in DOS mode.
Richn
.text
`.rdata
@.data
.pdata
@.rsrc
@.reloc
Centu
aulsu<
anghu*
VIA Padlock x86_64 module, CRYPTOGAMS by <[email protected]>
Genu
ineI
ntel
Auth
enti
cAMD
?mRRUR
RRUR
^u}TTMT
^J//
LL-LZa
VVEV
SSQS
Pu\\m\
\\m\
o.hs
SHA512 block transform for x86_64, CRYPTOGAMS by <[email protected]>
SHA256 block transform for x86_64, CRYPTOGAMS by <[email protected]>
ynA<M
SHA256 multi-block transform for x86_64, CRYPTOGAMS by <[email protected]>
SUATAUAVI
SUATAUAVH
SUATAUAV
SHA1 block transform for x86_64, CRYPTOGAMS by <[email protected]>
Aynd$
Aynt$
SHA1 multi-block transform for x86_64, CRYPTOGAMS by <[email protected]>
>H3ODH
ATAUAVH
Keccak-1600 absorb and squeeze for x86_64, CRYPTOGAMS by <[email protected]>
SATAUI
rc4(8x,int)
rc4(8x,char)
rc4(16x,int)
RC4 for x86_64, CRYPTOGAMS by <[email protected]>
Poly1305 for x86_64, CRYPTOGAMS by <[email protected]>
lbm$o
brc4a
GHASH for x86_64, CRYPTOGAMS by <[email protected]>
AES-NI GCM module for x86_64, CRYPTOGAMS by <[email protected]>
USATAVAWH
USATAUAVAWH
USATAUAVAWWH
X25519 primitives for x86_64, CRYPTOGAMS by <[email protected]>
s6!TYK
.Kc%
Hofw
.Q.Ol
.bmxz
ciO"A
\\MVT
=.TE
Vemn
PEIF
Qdsma
PAGN_4
BY_Lq)
aRWZ5
LG.HK
IChq
D.Hog^
.dx_LV9
rAGW
!AECO
7?XEAVn
k/.fG"
UEax
Go^ldg
K/VTR
;LGEW
.Vu{
"%sy'
U).ovc
CAAz
WZTR
%s q
wlLYP
M'Ezb
yyen
qTm_fC=
gTH.M
H.aR
XFle
Oh%u'
gXC.nT
C7HSY
RO%s.
*.Tn
kpEKI
fpnS
PHAG2
.Wqb^?
L4Eud
pRTH
YedcCH}
U RDn
mOD:V
SNtu
Tiid
VDPr
T;6P/Arc
_.oG
rixZ
orOF
C!OFtq74
.AJ[
,ARu@y6
.LH)
s(//
.yAu[7
CGP%AI
,%l*
ATAUL
ATAUM1
USATAUAVAWL
USATAUAVAW
ATAUH
orPH
onPH
expand 32-byte k
ChaCha20 for x86_64, CRYPTOGAMS by <[email protected]>
expa
onpf
yoL$P
bSEHC
rabq
.bq~H
ddde
\\\f
sssL
hAAA
1///
lLLL
DEEE
Camellia for x86_64 by <[email protected]>
Montgomery Multiplication with scatter/gather for x86_64, CRYPTOGAMS by <[email protected]>
Montgomery Multiplication for x86_64, CRYPTOGAMS by <[email protected]>
GF(2^m) Multiplication for x86_64, CRYPTOGAMS by <[email protected]>
Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)
A@tkf
$SUATAUAVH
AES for Intel AES-NI, CRYPTOGAMS by <[email protected]>
AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by <[email protected]>
zoWPE1
Azol$
Azol$
Azol$0
AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by <[email protected]>
F(rif
zot$ A
Azof
@SATAUH
t$ AWH
l$ AVH
|$ ATAVAWH
SUVWATAWH
l$ WATAVH
VWATAUAWH
t$ AVH
VWATAVAWH
@SUVWATH
@USVWATAUAVAWH
t$ UWATAVAWH
@USVWATAUAWH
workerId
type
thfff
@SVATAVH
L9IHE
i@tbH
@USVATAUH
@SWATAVAWH
EXI;E`t
M9Chs
@USVATAWH
code
data
\$ UVATAVAWH
UWATAVAWH
UWATAWI
UWATAUAWI
ERR_SSL_L
@USVH
@SUATAVH
@SUATH
@USWATAUH
k8toH
l$ VATAVH

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)

AddressBytesMnemonicOperands

0x1410cec7c4883ec28subrsp, 0x28

0x1410cec80e817040000call0x1410cf09c

0x1410cec854883c428addrsp, 0x28

0x1410cec89e972feffffjmp0x1410ceb00

0x1410cec8eccint3

0x1410cec8fccint3

0x1410cec90488bc4movrax, rsp

0x1410cec9348895808movqword ptr [rax + 8], rbx

0x1410cec9748896810movqword ptr [rax + 0x10], rbp

0x1410cec9b48897018movqword ptr [rax + 0x18], rsi

0x1410cec9f48897820movqword ptr [rax + 0x20], rdi

0x1410ceca34156pushr14

0x1410ceca54883ec20subrsp, 0x20

0x1410ceca9498b5938movrbx, qword ptr [r9 + 0x38]

0x1410cecad488bf2movrsi, rdx

0x1410cecb04d8bf0movr14, r8

0x1410cecb3488be9movrbp, rcx

0x1410cecb6498bd1movrdx, r9

0x1410cecb9488bcemovrcx, rsi

0x1410cecbc498bf9movrdi, r9

0x1410cecbf4c8d4304lear8, [rbx + 4]

0x1410cecc3e84cf5ffffcall0x1410ce214

0x1410cecc88b4504moveax, dword ptr [rbp + 4]

0x1410ceccb2466andal, 0x66

0x1410ceccdf6d8negal

0x1410ceccfb801000000moveax, 1

0x1410cecd4451bc0sbbr8d, r8d

0x1410cecd741f7d8negr8d

0x1410cecda4403c0addr8d, eax

0x1410cecdd44854304testdword ptr [rbx + 4], r8d

0x1410cece17411je0x1410cecf4

0x1410cece34c8bcfmovr9, rdi

0x1410cece64d8bc6movr8, r14

0x1410cece9488bd6movrdx, rsi

0x1410cecec488bcdmovrcx, rbp

0x1410cecefe838230000call0x1410d102c

0x1410cecf4488b5c2430movrbx, qword ptr [rsp + 0x30]

0x1410cecf9488b6c2438movrbp, qword ptr [rsp + 0x38]

0x1410cecfe488b742440movrsi, qword ptr [rsp + 0x40]

0x1410ced03488b7c2448movrdi, qword ptr [rsp + 0x48]

0x1410ced084883c420addrsp, 0x20

0x1410ced0c415epopr14

0x1410ced0ec3ret

0x1410ced0fccint3

0x1410ced10488d0d49f1c602learcx, [rip + 0x2c6f149]

0x1410ced1748ff25aad50400jmpqword ptr [rip + 0x4d5aa]

0x1410ced1eccint3

0x1410ced1fccint3

0x1410ced20488bc4movrax, rsp

0x1410ced2348895818movqword ptr [rax + 0x18], rbx

0x1410ced2748897020movqword ptr [rax + 0x20], rsi

0x1410ced2b48895010movqword ptr [rax + 0x10], rdx

0x1410ced2f48894808movqword ptr [rax + 8], rcx

0x1410ced3357pushrdi

0x1410ced344156pushr14

0x1410ced364157pushr15

0x1410ced384883ec30subrsp, 0x30

0x1410ced3c4d8bf9movr15, r9

0x1410ced3f4d8bf0movr14, r8

0x1410ced42488bf2movrsi, rdx

callbranchretstackarithregisterimmediatememory

Screen recording

20 frames · screen recording · 72s · ended early

The run was ended early from the console, so the recording covers only the 72s the sample actually ran.

1 / 20

0:00 · 1/20

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 71s · ended early

29 process(es) observed

LaunchedC:\Users\user\Desktop\Loader.exe

Privilegestandard

System File Execution Location Anomaly [T1036]

Telemetry sources: Kernel ETW (0 events) agent poll: 10In-process monitor: 21 19 kernel-only processes

Evasion / anti-analysis checks

3 checks

MED

Anti-debug API imports static-api

MITRE T1622 · getthreadcontext, isdebuggerpresent

MED

YARA: Suspicious_Anti_Debug_API Signature

MITRE T1497

LOW

CPUID hypervisor/feature probe static-instruction

MITRE T1497.001 · 3x cpuid - no timing or descriptor-table instruction beside it

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Living-off-the-land binaries

2 LOLBin abuses

MED

cmd chained command execution MITRE T1059.003

C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model""

MED

cmd chained command execution MITRE T1059.003

C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""

Command lines, unwrapped

6 read

6 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

29processes

3registry operations

Loader.exe

29 processes

Attributed activity

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 3 registry · sample scope

Files (0) Registry (3)

Operation	Target	Process
create	Software\Microsoft\WBEM\CIMOM	Loader.exe pid 3804
create	Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing certificate store	powershell.exe pid 1576
create	Software\Microsoft\SystemCertificates\CA certificate store	powershell.exe pid 1576
create	Software\Policies\Microsoft\SystemCertificates\CA certificate store	powershell.exe pid 1576
create	Software\Microsoft\EnterpriseCertificates\CA certificate store	powershell.exe pid 1576
create	SYSTEM\ControlSet001\Services\Tcpip\Parameters	Loader.exe pid 3804
create	Software\Microsoft\SystemCertificates\Disallowed certificate store	powershell.exe pid 1576
create	Software\Policies\Microsoft\SystemCertificates\Disallowed certificate store	powershell.exe pid 1576
create	Software\Microsoft\EnterpriseCertificates\Disallowed certificate store	powershell.exe pid 1576
create	Software\Microsoft\SystemCertificates\Root certificate store	powershell.exe pid 1576
create	Software\Microsoft\SystemCertificates\AuthRoot certificate store	powershell.exe pid 1576
create	Software\Policies\Microsoft\SystemCertificates\Root certificate store	powershell.exe pid 1576
create	Software\Microsoft\EnterpriseCertificates\Root certificate store	powershell.exe pid 1576
create	Software\Microsoft\SystemCertificates\SmartCardRoot certificate store	powershell.exe pid 1576
create	Software\Microsoft\SystemCertificates\TrustedPeople certificate store	powershell.exe pid 1576
create	Software\Policies\Microsoft\SystemCertificates\TrustedPeople certificate store	powershell.exe pid 1576
create	Software\Microsoft\EnterpriseCertificates\TrustedPeople certificate store	powershell.exe pid 1576
create	Software\Microsoft\SystemCertificates\trust certificate store	powershell.exe pid 1576
create	Software\Policies\Microsoft\SystemCertificates\trust certificate store	powershell.exe pid 1576
create	Software\Microsoft\EnterpriseCertificates\trust certificate store	powershell.exe pid 1576
create	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Loader.exe pid 3804

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

2 reported a hit 8 answered no 13 had nothing to check

2Sources with a hit

10Sources queriedof 23 available

470.5kFeed records

0Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	2,934 records 41 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 4 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,146 records 41 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,658 records 41 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check

Source	Checks	Result	Detail	Feed
blocklist.de	IP / domain / URL	not checked	no IP, domain or URL observed to check	27.6k records 41 minutes ago
CINS Army	IP / domain / URL	not checked	no IP, domain or URL observed to check	15k records 41 minutes ago
Emerging Threats	IP / domain / URL	not checked	no IP, domain or URL observed to check	482 records 41 minutes ago
Feodo Tracker	IP / domain / URL	not checked	no IP, domain or URL observed to check	5 records 41 minutes ago
IPsum	IP / domain / URL	not checked	no IP, domain or URL observed to check	19.7k records 41 minutes ago
Phishing.Database	IP / domain / URL	not checked	no IP, domain or URL observed to check	391.5k records 5 hours ago
ThreatFox	IP / domain / URL	not checked	no IP, domain or URL observed to check	1,146 records 41 minutes ago
URLhaus	IP / domain / URL	not checked	no IP, domain or URL observed to check	no records ingested

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 11 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

2 of 2 listed

Source	Checks	Result	Detail	Feed
Sigma rules	Behavior log	1 match	System File Execution Location Anomaly	2,275 records 6 hours ago
Signature rules	Sample content	9 matches	Suspicious_Anti_Debug_API, TigerRAT_pe_yaraify, Email_Generic_Phishing	110 records 42 minutes ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	29 process image paths, none masqueraded	245 records 42 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 41 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 41 minutes ago
LOLRMM	Names and domains	clean	30 name/domain indicators checked, no remote-management tooling	360 records 41 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

1 malicious 4 suspicious 0 info

File indicators

Severity	Type	Indicator	Description
suspicious	sample_sha256	a414ef0e41811a92bb5be4237136422c1ae38491e60a53abfc44a1426e45e497	Submitted sample (SHA256)
suspicious	sample_md5	8596494530ceb24e6802a473481a0b82	Submitted sample (MD5)
malicious	imphash	6acfab8924759c6fd3ec70a4c2fa5302	Import table hash (imphash)

Registry indicators

Severity	Type	Indicator	Description
suspicious	registry_key	SYSTEM\ControlSet001\Services\Tcpip\Parameters	Autostart / persistence key
suspicious	registry_key	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Autostart / persistence key

MITRE ATT&CK

1 technique

System File Execution Location Anomaly

T1036

Sigma detections

1 match of 2275 rules

Level	Detection	Log source	ATT&CK	Evidence
High	System File Execution Location Anomaly Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.	process_creation	T1036	process pid=5060, process pid=4544, process pid=4048

Generated rules

Sigma: auto_file_2603_sigma_reg

Auto-generated

title: Auto-generated registry behavior rule (sandbox scan 2603)
id: sandbox-auto-2603-reg
status: experimental
description: Auto-generated from sandbox scan 2603
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\WBEM\CIMOM'
            - 'SYSTEM\ControlSet001\Services\Tcpip\Parameters'
            - '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters'
    condition: selection
level: medium

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2603

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-10-01 23:21 Shown below	Windows 10 22H2	Malicious	87/100

Loader.exetigerrat analysis report - Malicious

Run integrity

Why this verdict

Model reading

Analysis layers

Sample

Run conditions

Malware family

Detection signatures

What the tests returned

Arguing against malice

How much weight this carries

Structure

Sections & resources

Signatures & packing

Strings

Code

Antivirus engine

Local ML assessment

Capabilities

Security mitigations

Rich header (toolchain)

Sections

Imports

Binary metadata

Code signing

Resources

Resources

Threat classification

Capability detection

Signature matches

Extracted strings

Disassembly

Nothing in this view

Screen recording

Behavior summary

Evasion / anti-analysis checks

Living-off-the-land binaries

Command lines, unwrapped

Network activity

Process tree

Loader.exe

Attributed activity

Persistence mechanisms

No persistence established

Detection coverage

File activity summary

Dropped payload analysis

File & registry ops

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

AI analysis

File indicators

Registry indicators

MITRE ATT&CK

Sigma detections

Generated rules

Sigma: auto_file_2603_sigma_reg

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file