0b1b9037233b62a601b31def961ed5a43773b7407d864c7ad40da9ab9ab91b71

Resubmissions

13-02-2024 23:59

240213-31s5ascb4v 8

13-02-2024 23:55

240213-3yxdyadd25 7

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher-2.899-Installer-1.1.5.exe
Size

24.9MB
MD5

dc18b7f4917cb800b1fa51251bc5b6b3
SHA1

268524e70c51f2f1e0eeb82ef183943aa5285a7c
SHA256

0b1b9037233b62a601b31def961ed5a43773b7407d864c7ad40da9ab9ab91b71
SHA512

e02ace9761c7736175b5a2c2541a51246adc5090c87724962362ec540118b331be1aeffbecd15b469eb4ee0ec29d436cd76b005ef7f7f34cad9084bb2ff03420
SSDEEP

393216:QXeigDRT3h2dPfs/dQETVlOBbpFEjLsZqV56HpkBrr6of5MJ7ZWqxPAIgtMIMlFN:QOigJ3hGHExiTZqqHpCrrKJBH5lFRqs

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	TLauncher-2.899-Installer-1.1.5.exe

Executes dropped EXE 1 IoCs

pid	Process
980	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
980	irsetup.exe
980	irsetup.exe
980	irsetup.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023131-5.dat	upx
behavioral2/memory/980-12-0x0000000000940000-0x0000000000D28000-memory.dmp	upx
behavioral2/memory/980-283-0x0000000000940000-0x0000000000D28000-memory.dmp	upx
behavioral2/memory/980-286-0x0000000000940000-0x0000000000D28000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
980	irsetup.exe
980	irsetup.exe
980	irsetup.exe
980	irsetup.exe
980	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 980	3352	TLauncher-2.899-Installer-1.1.5.exe	84
PID 3352 wrote to memory of 980	3352	TLauncher-2.899-Installer-1.1.5.exe	84
PID 3352 wrote to memory of 980	3352	TLauncher-2.899-Installer-1.1.5.exe	84

C:\Users\Admin\AppData\Local\Temp\TLauncher-2.899-Installer-1.1.5.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.899-Installer-1.1.5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.899-Installer-1.1.5.exe" "__IRCT:3" "__IRTSS:26073958" "__IRSID:S-1-5-21-3073191680-435865314-2862784915-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.8MB

MD5
cb50d496ae05fa1c8bfbcb3b7f910bfe

SHA1
3ec4d77b73c4d7e9858b11224314e99d082497a8

SHA256
7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

SHA512
22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
1bbf5dd0b6ca80e4c7c77495c3f33083

SHA1
e0520037e60eb641ec04d1e814394c9da0a6a862

SHA256
bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

SHA512
97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
bba68732fb535f542f19acd46af00ddf

SHA1
501b7058ce18858a22f6ce198dfc34fff832872d

SHA256
da4577994a0653b6eccea81ecd078397f2088935d24dde5d8de30fbf178dd0e3

SHA512
36b3d68b7163b7be4a12cc9b6fed2136300c8fdc4941e00b42faffe94f40436d104788808d4fcccfb7340e3b4a4bc4740bd66dab840260461a8ecc7785fe43b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
307KB

MD5
604a3b306f4d56ae57690b4c032b447d

SHA1
db9fefe7cbe3a3dbbda6e8080cd447d2b011f1d2

SHA256
420a0ebc1c6253722fca4f12a364f91376d98e89cc81577d7ff4c05e78750ef6

SHA512
efa31e7ba611bf52ad7b143a812823034bd22c33b53e13656075056de7c4fcd88b06be55f029c9b4632de89d3bf3825a36d2617930277048b38a6345b300b8ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
128KB

MD5
0dd4ef6d2886449d041dc72352a8c1be

SHA1
4819159a9cc6c599d85c2ec8831e566234f2d152

SHA256
b830066122968503a20052359dc05e6af8221462002fbbf15359323c255ac00b

SHA512
16a5f4755b6f2b331dc2cc49bc56aaa1155a573784ee47f334f0c76bf648af97a6863c590129f01e264dc629a5c7407e203c7896b0d38d0962e9d1c775962356

Download Submit
memory/980-266-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/980-267-0x0000000006D40000-0x0000000006D43000-memory.dmp

Filesize
12KB

Download
memory/980-12-0x0000000000940000-0x0000000000D28000-memory.dmp

Filesize
3.9MB

Download
memory/980-283-0x0000000000940000-0x0000000000D28000-memory.dmp

Filesize
3.9MB

Download
memory/980-284-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/980-286-0x0000000000940000-0x0000000000D28000-memory.dmp

Filesize
3.9MB

Download
memory/980-287-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/980-290-0x0000000006D40000-0x0000000006D43000-memory.dmp

Filesize
12KB

Download