72233ab932b1a4eda72de60a0b7e5613721d3158dcf2c747af03b994d304da30

General

Target

TLauncher-2.831-Installer-0.8.6.exe
Size

20.9MB
MD5

2bc7b3bd8077f71e28ae81ffa5061c7d
SHA1

6f21f591eed05cc7f47d245acebc25c013cda49a
SHA256

72233ab932b1a4eda72de60a0b7e5613721d3158dcf2c747af03b994d304da30
SHA512

9424557bcd668ff18a47ad7dc6ce931858ab70504f0777f2d8613a72386f1fc34152c2e45851b63b02c08d364bd0bfd1447be1c37bc5de6cf4598149994f99cc
SSDEEP

393216:sXn+p6FPPXJQ2NM0fs/dQETVlOBbpFEj9GZdqV56Hpk9/rtztBvaeg4p:sXm6FW2FHExiTTqqHpW/rtzz1Bp

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	TLauncher-2.831-Installer-0.8.6.exe

Executes dropped EXE 1 IoCs

pid	Process
2160	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
2160	irsetup.exe
2160	irsetup.exe
2160	irsetup.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000300000001e64b-133.dat	upx
behavioral2/files/0x000300000001e64b-134.dat	upx
behavioral2/memory/2160-137-0x0000000000D90000-0x0000000001178000-memory.dmp	upx
behavioral2/memory/2160-142-0x0000000000D90000-0x0000000001178000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2160	irsetup.exe
2160	irsetup.exe
2160	irsetup.exe
2160	irsetup.exe
2160	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2160	804	TLauncher-2.831-Installer-0.8.6.exe	80
PID 804 wrote to memory of 2160	804	TLauncher-2.831-Installer-0.8.6.exe	80
PID 804 wrote to memory of 2160	804	TLauncher-2.831-Installer-0.8.6.exe	80

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.831-Installer-0.8.6.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.831-Installer-0.8.6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1908426 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.831-Installer-0.8.6.exe" "__IRCT:3" "__IRTSS:21919367" "__IRSID:S-1-5-21-2629973501-4017243118-3254762364-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
4ee08e6a216c55e8edbbca5ac48c0705

SHA1
193e017b4dbe59d6bf6147ee8996c1625b0ba2a7

SHA256
1dda9e371c63f78af916eac31cd48c5524501b5235b9c11b7408dbd370a68666

SHA512
091a833bd6825a264d5a20ac83e11663445e096331f6c728d7e5466a80ff278c55442dcd2c7b8d8bf14b035d555dee7957f111c110b71a4fb1147f27c79069bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
4ee08e6a216c55e8edbbca5ac48c0705

SHA1
193e017b4dbe59d6bf6147ee8996c1625b0ba2a7

SHA256
1dda9e371c63f78af916eac31cd48c5524501b5235b9c11b7408dbd370a68666

SHA512
091a833bd6825a264d5a20ac83e11663445e096331f6c728d7e5466a80ff278c55442dcd2c7b8d8bf14b035d555dee7957f111c110b71a4fb1147f27c79069bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
80d93d38badecdd2b134fe4699721223

SHA1
e829e58091bae93bc64e0c6f9f0bac999cfda23d

SHA256
c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

SHA512
9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

Download Submit
memory/2160-137-0x0000000000D90000-0x0000000001178000-memory.dmp

Filesize
3.9MB

Download
memory/2160-140-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2160-141-0x00000000065F0000-0x00000000065F3000-memory.dmp

Filesize
12KB

Download
memory/2160-142-0x0000000000D90000-0x0000000001178000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing