Analysis

  • max time kernel
    449s
  • max time network
    452s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    11/03/2024, 10:06

General

  • Target

    prismlauncher_updater.exe

  • Size

    719KB

  • MD5

    e0bad364bcd82a859df7855d0bac1811

  • SHA1

    e87fbff416cf3fb667345c5e8ef49abf3bd5da24

  • SHA256

    da9b8dee843e3448dee6ea5efe045f3bab5f12beea77269f1132de57e2dbbbd9

  • SHA512

    528143ae7b50d5cad16d6f458f4cf60e639ee30b8c7924fdb33200f48d30a1bb4524927f2cd338f5a48fde636d6db4ed41b2b8c9ff7f977f51404494735961d3

  • SSDEEP

    12288:lah1mPo7YtzgqXhKRts8BrRDTvXOY71+14K597dn/MopZmH8GV7zv4injV4uL:2wPo7Y9gqRinBrtrjkcjVr

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\prismlauncher_updater.exe
    "C:\Users\Admin\AppData\Local\Temp\prismlauncher_updater.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Users\Admin\AppData\Local\Temp\prismlauncher.exe
      C:\Users\Admin\AppData\Local\Temp\prismlauncher.exe --version
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      PID:3528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3528-14-0x00007FF714CB0000-0x00007FF715676000-memory.dmp

    Filesize

    9.8MB

  • memory/3528-13-0x00007FFFDF080000-0x00007FFFDF6AD000-memory.dmp

    Filesize

    6.2MB

  • memory/3528-15-0x0000023A619D0000-0x0000023A619E0000-memory.dmp

    Filesize

    64KB

  • memory/4960-0-0x00007FFFDF080000-0x00007FFFDF6AD000-memory.dmp

    Filesize

    6.2MB

  • memory/4960-1-0x0000021EBCD90000-0x0000021EBCDA0000-memory.dmp

    Filesize

    64KB