Overview
overview
7Static
static
3Hack Launc...er.exe
windows7-x64
7Hack Launc...er.exe
windows10-2004-x64
7Hack Launc...ck.dll
windows7-x64
1Hack Launc...ck.dll
windows10-2004-x64
1Hack Launc...32.dll
windows7-x64
3Hack Launc...32.dll
windows10-2004-x64
3Hack Launc...ws.dll
windows7-x64
1Hack Launc...ws.dll
windows10-2004-x64
1Hack Launc...e4.dll
windows7-x64
3Hack Launc...e4.dll
windows10-2004-x64
3Hack Launc...-1.dll
windows7-x64
3Hack Launc...-1.dll
windows10-2004-x64
3Hack Launc...10.dll
windows7-x64
1Hack Launc...10.dll
windows10-2004-x64
1Hack Launc...rs.dll
windows7-x64
1Hack Launc...rs.dll
windows10-2004-x64
1Analysis
-
max time kernel
125s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2023, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
Hack Launcher/Launcher.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
Hack Launcher/Launcher.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Hack Launcher/hack.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral4
Sample
Hack Launcher/hack.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Hack Launcher/irmfmodulewin32.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral6
Sample
Hack Launcher/irmfmodulewin32.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Hack Launcher/platforms/qwindows.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral8
Sample
Hack Launcher/platforms/qwindows.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Hack Launcher/source/QtCore4.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral10
Sample
Hack Launcher/source/QtCore4.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Hack Launcher/source/libgcc_s_dw2-1.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral12
Sample
Hack Launcher/source/libgcc_s_dw2-1.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Hack Launcher/source/mingwm10.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral14
Sample
Hack Launcher/source/mingwm10.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Hack Launcher/updater/bdfilters.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral16
Sample
Hack Launcher/updater/bdfilters.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
General
-
Target
Hack Launcher/updater/bdfilters.dll
-
Size
4.1MB
-
MD5
ed730387fdcd684b756601b863c47417
-
SHA1
c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde
-
SHA256
9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5
-
SHA512
e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f
-
SSDEEP
98304:Xl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KChvvvveo:XuqYuQxqYfHYosUiJoviVKvvvvJ
Malware Config
Signatures
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hack Launcher\\updater\\bdfilters.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hack Launcher\\updater\\bdfilters.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\FriendlyName = "Bandicam MPEG-1 Video Decoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hack Launcher\\updater\\bdfilters.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\FriendlyName = "Bandicam MPEG-1 Audio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\ = "Bandicam MPEG-1 Audio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\ = "Bandicam MPEG-1 Audio Property" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hack Launcher\\updater\\bdfilters.dll" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\FilterData = 02000000010080ff02000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b714d50454700001000800000aa00389b714d50473100001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\CLSID = "{E2E7539A-CECF-4A6A-B187-939943ECEF05}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\ = "Bandicam MPEG-1 Video Decoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\CLSID = "{89C4B786-A490-4A3E-AA70-E6A8C61D3689}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\ = "Bandicam MPEG-1 Video Property" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\FilterData = 02000000010080ff020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b715000000000001000800000aa00389b710100000000001000800000aa00389b71 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3204 wrote to memory of 2344 3204 regsvr32.exe 83 PID 3204 wrote to memory of 2344 3204 regsvr32.exe 83 PID 3204 wrote to memory of 2344 3204 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Hack Launcher\updater\bdfilters.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\Hack Launcher\updater\bdfilters.dll"2⤵
- Modifies registry class
PID:2344
-