c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620

Resubmissions

09/06/2023, 20:55

230609-zqyegsec5v 7

09/06/2023, 20:43

230609-zhqpnsde28 7

09/06/2023, 20:39

230609-zfaknsec2y 7

Analysis

max time kernel
1757s
max time network
1503s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2023, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher 3.1.exe
Size

1.1MB
MD5

021b53abfc25a261077282498e5726a0
SHA1

ba7f38a28444504e6e8e1f995cc40ceb70ff6409
SHA256

c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620
SHA512

484bb65ecb1ccd3e5472a27737fd2fa4471240aeefcf4bfdeaf4e49636cec9b3e43a5c2feb7134074c92af01f52a456b8074aca8269480e210cfa3b51acae81d
SSDEEP

24576:7h1tjL2uma7hLQKaikK21SHCJ3ny+SGiPsGSa7tLC+/e0cUEcnr:sghMKai1viny6iPH5hF/e0m2r

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2016	javaw.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2016	javaw.exe
2016	javaw.exe
2016	javaw.exe
2016	javaw.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2016	1628	SKlauncher 3.1.exe	85
PID 1628 wrote to memory of 2016	1628	SKlauncher 3.1.exe	85
PID 2016 wrote to memory of 2616	2016	javaw.exe	95
PID 2016 wrote to memory of 2616	2016	javaw.exe	95

C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
    3⤵
    PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4094152735000.dll

Filesize
21KB

MD5
4ca3290a99adadde557930cd481d7539

SHA1
26034442a76131dd3d37c8f28b6e9bebc7c1fe7c

SHA256
dd130c68dc36bcedbe51a6b8ec3b3358a460d45952f6280e12331f48850b6b3b

SHA512
9341c60f92dd3f89f82555055924bdae6fcce1e4cd13a7dde5129ebdce04bae377292237a2ed6c3e7623b242e82b01c7ed1717af4d7db8ca473e9fd7b7b190d5

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar

Filesize
14.2MB

MD5
676e6288fbc1dca2e34fbfc318254d79

SHA1
422fedee8ffbf4938700eb8da333accf84e39f35

SHA256
dd09da7835de78b8638afe6f12f76ea7901f482d22df723133babbc14db2faf2

SHA512
5c9e88cfb361115ac5bf5a1c83bfbaf0ecf0b1054319a021a5c214862b4e54ab6cd296a70b7469ba810ecd3f71362d75e2e7c0d1d728b9d6dd5d6d663331f8ff

Download Submit
memory/1628-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2016-225-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-232-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-195-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-197-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-200-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-213-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-221-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-222-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-223-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-148-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-228-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-180-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-236-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-246-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-249-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-253-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-272-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-273-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-278-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-283-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-144-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-297-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-303-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2016-307-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads