Overview

overview

7

Static

static

3

LegacyLaun...cl.exe

windows7-x64

7

LegacyLaun...cl.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 16:41 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LegacyLauncher_Installer_mcl.exe

  • Size

    112.3MB

  • MD5

    71f8ce4a8f559dca25662bbaa496fa7f

  • SHA1

    09899d58b121ef998d894ca01d9be6408be091c4

  • SHA256

    f39c0091f56186d91804f2051699ecdd1cce2bc6c51e133250653eff26b8e0f0

  • SHA512

    f3d5b6069893fc819b915487db6b8c067716c9d961ddfecb9c4b17c2fd4443a333905963cf626e258163a9509a59a5d33f7eb7c7c1108b7d08e27659447d8819

  • SSDEEP

    1572864:OCR3EXzMNaTUn8gquVvsaq/cBwI2ek+b7r0nKT5wfomYadr420Dt7RweD+gT9i0:T3uINa4nR4EBNlh5QjYads267REgT9t

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_Installer_mcl.exe
    "C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_Installer_mcl.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Users\Admin\AppData\Local\Temp\is-0KEPT.tmp\LegacyLauncher_Installer_mcl.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0KEPT.tmp\LegacyLauncher_Installer_mcl.tmp" /SL5="$90218,115846600,1202688,C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_Installer_mcl.exe"
      2⤵
      • Executes dropped EXE
      PID:632

Network

  • flag-us
    DNS
    183.142.211.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.142.211.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    176.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.178.17.96.in-addr.arpa
    IN PTR
    Response
    176.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-176deploystaticakamaitechnologiescom
  • flag-us
    DNS
    5.181.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    5.181.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    16.234.44.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    16.234.44.23.in-addr.arpa
    IN PTR
    Response
    16.234.44.23.in-addr.arpa
    IN PTR
    a23-44-234-16deploystaticakamaitechnologiescom
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    147.166.122.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    147.166.122.92.in-addr.arpa
    IN PTR
    Response
    147.166.122.92.in-addr.arpa
    IN PTR
    a92-122-166-147deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    225.162.46.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    225.162.46.104.in-addr.arpa
    IN PTR
    Response
  • 52.142.223.178:80
    52 B
     1
  • 8.8.8.8:53
    183.142.211.20.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    183.142.211.20.in-addr.arpa

  • 8.8.8.8:53
    176.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    176.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    5.181.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    5.181.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    16.234.44.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    16.234.44.23.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    147.166.122.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    147.166.122.92.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    225.162.46.104.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    225.162.46.104.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-0KEPT.tmp\LegacyLauncher_Installer_mcl.tmp
    Filesize

    3.4MB

    MD5

    593cf730ff2ce30aa845e233442c5a8a

    SHA1

    f1aa311f76ef96d97895a78ea00dfd7900ff6bd7

    SHA256

    dfc6d2611a5d7ff0df3375ae45da91f31b9a1bc9e3a7b1580b39d8efdaf8d2bb

    SHA512

    5feac04c20261109cd241623ef6ceed9ee3ac9567d45bf766bc8592c329eb983b3053c004af741f420df8eae0f67ddd9effb36c2bc0d0bd79c7566257405fb6a

    Download Submit

  • memory/632-6-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

    Download

  • memory/632-9-0x0000000000400000-0x0000000000776000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/632-12-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4628-0-0x0000000000400000-0x0000000000533000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4628-8-0x0000000000400000-0x0000000000533000-memory.dmp

    Filesize

    1.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.