f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0

Analysis

max time kernel
142s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.885-Installer-1.1.3.exe
Size

22.6MB
MD5

bd3eefe3f5a4bb0c948251a5d05727e7
SHA1

b18722304d297aa384a024444aadd4e5f54a115e
SHA256

f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0
SHA512

d7df966eeda90bf074249ba983aac4ba32a7f09fe4bb6d95811951df08f24e55e01c790ffebc3bc50ce7b1c501ff562f0de5e01ca340c8596881f69f8fed932d
SSDEEP

393216:KXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:K2/BhSHExi73qqHpu34kYbzOc

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2280	irsetup.exe

Loads dropped DLL 7 IoCs

pid	Process
2644	TLauncher-2.885-Installer-1.1.3.exe
2644	TLauncher-2.885-Installer-1.1.3.exe
2644	TLauncher-2.885-Installer-1.1.3.exe
2644	TLauncher-2.885-Installer-1.1.3.exe
2280	irsetup.exe
2280	irsetup.exe
2280	irsetup.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a00000001225e-3.dat	upx
behavioral1/memory/2644-5-0x0000000002DF0000-0x00000000031D8000-memory.dmp	upx
behavioral1/files/0x000a00000001225e-7.dat	upx
behavioral1/files/0x000a00000001225e-13.dat	upx
behavioral1/files/0x000a00000001225e-11.dat	upx
behavioral1/files/0x000a00000001225e-16.dat	upx
behavioral1/memory/2280-17-0x0000000001180000-0x0000000001568000-memory.dmp	upx
behavioral1/memory/2280-333-0x0000000001180000-0x0000000001568000-memory.dmp	upx
behavioral1/memory/2280-340-0x0000000001180000-0x0000000001568000-memory.dmp	upx
behavioral1/memory/2280-359-0x0000000001180000-0x0000000001568000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	irsetup.exe
2280	irsetup.exe
2280	irsetup.exe
2280	irsetup.exe
2280	irsetup.exe
2280	irsetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2280	2644	TLauncher-2.885-Installer-1.1.3.exe	28
PID 2644 wrote to memory of 2280	2644	TLauncher-2.885-Installer-1.1.3.exe	28
PID 2644 wrote to memory of 2280	2644	TLauncher-2.885-Installer-1.1.3.exe	28
PID 2644 wrote to memory of 2280	2644	TLauncher-2.885-Installer-1.1.3.exe	28
PID 2644 wrote to memory of 2280	2644	TLauncher-2.885-Installer-1.1.3.exe	28
PID 2644 wrote to memory of 2280	2644	TLauncher-2.885-Installer-1.1.3.exe	28
PID 2644 wrote to memory of 2280	2644	TLauncher-2.885-Installer-1.1.3.exe	28

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe" "__IRCT:3" "__IRTSS:23661420" "__IRSID:S-1-5-21-3427588347-1492276948-3422228430-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
cb50d496ae05fa1c8bfbcb3b7f910bfe

SHA1
3ec4d77b73c4d7e9858b11224314e99d082497a8

SHA256
7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

SHA512
22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

Filesize
280B

MD5
5803b5d5f862418b64caa83396e69c7f

SHA1
97b6c8209b8ad65f4f9f3b953fe966bb09ee4e13

SHA256
ee340f8560ba2e71d7e6d305b959ff8fa77869dac916287da2bff7ce5aa2e159

SHA512
e9bf37f0c89299bfa369a8677ac56b12177dd3153246e5e6a9390577658111b731b0ab987044d30f43e05cb41d79ed31dae3b6f4521f225925920617d0414edd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

Filesize
281B

MD5
60a19921c7ff3c75e28c302f95460994

SHA1
07ac64ffbb153c8675e2ce0651afeaa5e8c6652d

SHA256
33341d30463fbc7cf3fba5070925569c822b6835aabdb8ef2c3cf09547912d46

SHA512
b30b960152dc13b1a9d384c4972169392cd405bdf4d3ecf73f85cf8a9a68a075131b2495c0348f54d43d0e7a279907bc7b76ac103f4a624738cbfc73bbeeba02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
320KB

MD5
990e8fbcb5aa8d09da9c7167494bad0f

SHA1
ff3fa2bc51842fd6f16a54d275c045a83b67c798

SHA256
668157a6d976bd25b28ff485654818dbb3869ab0ff2f27c99004f261d2bf6310

SHA512
087cf4dc6ea9c2f75b046abadbe9e0330b42a45be9516966c6c690a0c59862468803d42efb635445ebf2fe4b30a0a0e517512c55c1a7dca6d8696b0f5a1c09d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
448KB

MD5
214565d5ea1fb05c42358becc48acc6c

SHA1
23b7b8e10fa1b02a71bd442fa09e595712354ace

SHA256
8172c08bde8edc2fb7f1cf6ab33378ca660244e641caade51df61390d38ceec6

SHA512
a7412f76fc4eeafd72c0d525dc0b94f1e96480f63b1ab2707c0d761c1b8051c69769a5e22c00fcec730c1155ba66e25d03d501524addf2bf3c72ef2a6b6c7058

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
14KB

MD5
a2def338fd687801756bcb8b333c2292

SHA1
9d3639c24c30b01e830437316120671fdb9070e0

SHA256
98fe065ebd284107cc49890508b05ae46aaf75796af489f20088a995fba501d2

SHA512
49b82851f74d3992f1f83aecae51ed405449acd75f2fa808799cff18349344d8dccb23dc0be44067750be9223b5e1f572284e68a17d1ff6ebe0d9947f162564e

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
96664ea19c6011e47589541b79a8210c

SHA1
a5b4391237037d60a686375745fa2f1a56105e85

SHA256
a8a0ed01cb20d12d83b5c288b545270950c9435574da64438d61c66931a15f97

SHA512
84ae0d8b077aea36e0fbabdb81a04bf6433a93b3e5d7b150115e2e2211aefbff167c84c7e890c56df3b3aa2a90eeb3c0f7b7d046e70f08621d7bf3ff3123438f

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
960KB

MD5
04d9f49704477d5ded84b6ae2405b7e3

SHA1
5001432615d8d5fe6ac97a765534dff248f3386f

SHA256
23cf93326a801e0b164259e2c55f52da66e7c7e79b9c17a133c9af99a8b2c084

SHA512
7a4b8651a8fdd73ba028acc80c85272c030bf36b41482bc5224deeb8848d0d71c242b59384cb1e2745862561c52a2a1119d27b293192a6a4dc5aeed7b071807c

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
a70accbc1f1001cbf1c4a139e4e5d7af

SHA1
138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

SHA256
b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

SHA512
46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
4KB

MD5
316bc43972cd851e5f419db3c27047ae

SHA1
a97695610e492fe00504a2eb7d837578c5ec11a2

SHA256
4534ce2bd3a893ffe41213467962c8d7b92ca902f79aeec8c33ece5dacaafe57

SHA512
7a2d87d89a89de1d9bdcc3fe593284e56f0912afe333a0b92d67634ebc7b805166623e2e55915f0c4b24c25cfd412b75300ba8e96cf6cd81a878e7cc02543779

Download Submit
memory/2280-306-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2280-308-0x0000000000B60000-0x0000000000B63000-memory.dmp

Filesize
12KB

Download
memory/2280-17-0x0000000001180000-0x0000000001568000-memory.dmp

Filesize
3.9MB

Download
memory/2280-333-0x0000000001180000-0x0000000001568000-memory.dmp

Filesize
3.9MB

Download
memory/2280-334-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2280-340-0x0000000001180000-0x0000000001568000-memory.dmp

Filesize
3.9MB

Download
memory/2280-341-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2280-359-0x0000000001180000-0x0000000001568000-memory.dmp

Filesize
3.9MB

Download
memory/2280-380-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/2644-339-0x0000000002DF0000-0x00000000031D8000-memory.dmp

Filesize
3.9MB

Download
memory/2644-15-0x0000000002DF0000-0x00000000031D8000-memory.dmp

Filesize
3.9MB

Download
memory/2644-5-0x0000000002DF0000-0x00000000031D8000-memory.dmp

Filesize
3.9MB

Download