Overview
overview
7Static
static
3Launcher S....0.exe
windows7-x64
7Launcher S....0.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Launcher.exe
windows7-x64
7Launcher.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/fa.ps1
windows7-x64
1locales/fa.ps1
windows10-2004-x64
1locales/hi.ps1
windows7-x64
1locales/hi.ps1
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
Launcher Setup 9.8.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Launcher Setup 9.8.0.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
Launcher.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Launcher.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral22
Sample
locales/fa.ps1
Resource
win7-20240215-en
Behavioral task
behavioral23
Sample
locales/fa.ps1
Resource
win10v2004-20240221-en
Behavioral task
behavioral24
Sample
locales/hi.ps1
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
locales/hi.ps1
Resource
win10v2004-20240221-en
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
General
-
Target
Launcher Setup 9.8.0.exe
-
Size
81.7MB
-
MD5
7720b7b67d96a9da8793ea739df043ff
-
SHA1
d8a894f47285c7e14aec01826b0f3d2dd926942b
-
SHA256
5a34604b347dc11a911ab082f8ed3328d7fa6e5f67b4daccf68cc9e9291e7996
-
SHA512
7d785523d52dd7e1ffb779c6ac3ff549a34a4c638207e33551d66918d5d8910ba59511f25884b9d455f1d05a031a46733cabb7bc623b0d1d2a0cc16a9ca56ecd
-
SSDEEP
1572864:lHl+n66AE9p/WCbKVeygDf1IYiQSRkEv6LJAWld6CSUc97WiQrOptIoT4pG:l8n66AEScEe/9GkBNADCS5LQrOptGY
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2596 Launcher Setup 9.8.0.exe 2596 Launcher Setup 9.8.0.exe 2596 Launcher Setup 9.8.0.exe 2596 Launcher Setup 9.8.0.exe 2596 Launcher Setup 9.8.0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2572 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2596 Launcher Setup 9.8.0.exe 2572 tasklist.exe 2572 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2572 tasklist.exe Token: SeSecurityPrivilege 2596 Launcher Setup 9.8.0.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2580 2596 Launcher Setup 9.8.0.exe 30 PID 2596 wrote to memory of 2580 2596 Launcher Setup 9.8.0.exe 30 PID 2596 wrote to memory of 2580 2596 Launcher Setup 9.8.0.exe 30 PID 2596 wrote to memory of 2580 2596 Launcher Setup 9.8.0.exe 30 PID 2596 wrote to memory of 2580 2596 Launcher Setup 9.8.0.exe 30 PID 2596 wrote to memory of 2580 2596 Launcher Setup 9.8.0.exe 30 PID 2596 wrote to memory of 2580 2596 Launcher Setup 9.8.0.exe 30 PID 2580 wrote to memory of 2572 2580 cmd.exe 32 PID 2580 wrote to memory of 2572 2580 cmd.exe 32 PID 2580 wrote to memory of 2572 2580 cmd.exe 32 PID 2580 wrote to memory of 2572 2580 cmd.exe 32 PID 2580 wrote to memory of 2572 2580 cmd.exe 32 PID 2580 wrote to memory of 2572 2580 cmd.exe 32 PID 2580 wrote to memory of 2572 2580 cmd.exe 32 PID 2580 wrote to memory of 2452 2580 cmd.exe 33 PID 2580 wrote to memory of 2452 2580 cmd.exe 33 PID 2580 wrote to memory of 2452 2580 cmd.exe 33 PID 2580 wrote to memory of 2452 2580 cmd.exe 33 PID 2580 wrote to memory of 2452 2580 cmd.exe 33 PID 2580 wrote to memory of 2452 2580 cmd.exe 33 PID 2580 wrote to memory of 2452 2580 cmd.exe 33
Processes
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe"C:\Users\Admin\AppData\Local\Temp\Launcher Setup 9.8.0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Launcher.exe" | %SYSTEMROOT%\System32\find.exe "Launcher.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Launcher.exe"3⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "Launcher.exe"3⤵PID:2452
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df