Overview
overview
7Static
static
3Launcher S....0.exe
windows7-x64
7Launcher S....0.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Launcher.exe
windows7-x64
7Launcher.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/fa.ps1
windows7-x64
1locales/fa.ps1
windows10-2004-x64
1locales/hi.ps1
windows7-x64
1locales/hi.ps1
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3Analysis
-
max time kernel
7s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
Launcher Setup 9.8.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Launcher Setup 9.8.0.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
Launcher.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Launcher.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral22
Sample
locales/fa.ps1
Resource
win7-20240215-en
Behavioral task
behavioral23
Sample
locales/fa.ps1
Resource
win10v2004-20240221-en
Behavioral task
behavioral24
Sample
locales/hi.ps1
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
locales/hi.ps1
Resource
win10v2004-20240221-en
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
General
-
Target
Launcher.exe
-
Size
150.4MB
-
MD5
e4483aed6275e7e66d5a559ad0444d78
-
SHA1
09c6508c8fd9068220a7fa632fffc2d41877d344
-
SHA256
af42e42f286a98231e728bcfc4267b730849a0b373833b609184435b9fd628f6
-
SHA512
6d6e87000a35adedd391ca76f2bbf456095768c632fb8de0c1f718fa720f8d58e1f71001be7fcfd1cb311124b981677626de5994200088acc423a887b0bc5627
-
SSDEEP
1572864:I9sIp9dePx3boQ9zPx3veCvI+RJjaWIxdaJgAOB3i3wFO6Bj3yTEQjB4UR9OEm3:Ke15JHHgw9m
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\International\Geo\Nation Launcher.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2828 Launcher.exe Token: SeShutdownPrivilege 2828 Launcher.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2632 2828 Launcher.exe 28 PID 2828 wrote to memory of 2672 2828 Launcher.exe 30 PID 2828 wrote to memory of 2672 2828 Launcher.exe 30 PID 2828 wrote to memory of 2672 2828 Launcher.exe 30 PID 2828 wrote to memory of 2916 2828 Launcher.exe 29 PID 2828 wrote to memory of 2916 2828 Launcher.exe 29 PID 2828 wrote to memory of 2916 2828 Launcher.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=984 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1512 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=1248 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1508 --field-trial-handle=1092,i,1788158163437963443,6669828850419296866,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d56c95e2082ae944d69b078a71c73ae
SHA1a59802c89557ba9a31574e5caeb50a9ce8513d46
SHA256b3d19fffcbe78c2ea8042e6cfc7335bec84f9713ff38ee6e867d650b7153abd7
SHA5125fa72202513d98c596670c90df1cb235bd9e0e5a64513e5a5e3bc5257770c2522fed8ccce8cb2bc815c263cc85d49d4b71f8dcef83d06ba2d1df9aaee30d0e50
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23