Overview

overview

7

Static

static

3

setup.exe

windows7-x64

7

setup.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

Salwyrr Launcher.exe

windows7-x64

7

Salwyrr Launcher.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

owutility.dll

windows7-x64

1

owutility.dll

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

resources/...ct.jar

windows7-x64

1

resources/...ct.jar

windows10-2004-x64

7

resources/...er.jar

windows7-x64

1

resources/...er.jar

windows10-2004-x64

7

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

Analysis

  • max time kernel
    152s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2024, 01:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Salwyrr Launcher.exe
  • Size 150.5MB
  • Sample240408-bgnxpaca9x
  • SHA256 bcc98408be7d77e03ca6fd8f1e7e01d30f3b55e3bb236735d514037f6b2da53f
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Modifies system certificate store 2 TTPs 35 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        3⤵
          PID:4136
      • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1764,i,9668307850892278800,256161160061231847,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
          PID:2344
        • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --mojo-platform-channel-handle=1840 --field-trial-handle=1764,i,9668307850892278800,256161160061231847,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
          2⤵
            PID:1996
          • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2396 --field-trial-handle=1764,i,9668307850892278800,256161160061231847,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
            2⤵
            • Checks computer location settings
            PID:3104
          • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=cs "--cs-app=Salwyrr Launcher"
            2⤵
              PID:4512
            • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
              "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3852 --field-trial-handle=1764,i,9668307850892278800,256161160061231847,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
              2⤵
              • Checks computer location settings
              PID:4268
            • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
              "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3984 --field-trial-handle=1764,i,9668307850892278800,256161160061231847,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
              2⤵
              • Checks computer location settings
              PID:3592
            • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
              "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3860 --field-trial-handle=1764,i,9668307850892278800,256161160061231847,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
              2⤵
              • Checks computer location settings
              PID:2416
            • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
              "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3652 --field-trial-handle=1764,i,9668307850892278800,256161160061231847,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3128

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                070E0202839D9D67350CD2613E78E416
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
                • Size 1KB
                • SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
                • MD5 SHA1 SHA512
                Submit Download

                default.dic
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                17b0f595-ba66-4ec4-aacd-24a32ed102a7.tmp
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\17b0f595-ba66-4ec4-aacd-24a32ed102a7.tmp
                • Size 57B
                • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                • MD5 SHA1 SHA512
                Submit Download

                f_000001
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000001
                • Size 17KB
                • SHA256 4601215325c3092bf758cf29d522a73057dad81f3081057d716b62193fa2e3f3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_000005
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000005
                • Size 28KB
                • SHA256 7b999c45136341436bc2ce5fcabc27421d3d10d7e29cb5ce2f3c87b3ec93791e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_000006
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000006
                • Size 137KB
                • SHA256 54d8fdb63948f89f878e0b785b1ab7c275f8ecaa5e20048e6311f1a85e7f328d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_000007
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000007
                • Size 33KB
                • SHA256 462e9d5359c0ce798c787ac9859f72d07fb54c51643630b96c38c4e020a63d4e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_00000e
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_00000e
                • Size 73KB
                • SHA256 cbe43b67166042dd1e906aadb083efd75c277eec935eb805ca0778387f8ecd35
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_000014
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000014
                • Size 26KB
                • SHA256 56cf134edde3cf222a6d23b1303327dd475caffa6b6b9467a5d7173e8233d31c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_000016
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000016
                • Size 16KB
                • SHA256 e5c29c139842fd487473d0824f2c01b374680fb35d22fa929686d17896602a44
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_00001b
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_00001b
                • Size 29KB
                • SHA256 be8f4fac2d40747a0adaecc6f1befe81b254a2b12bf25ce01d7194b374a457fc
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
                • Size 48B
                • SHA256 69f59d4d0081d69e338667c6567e808c4d8ad798d8e22fcfa69fe5eb985ab2e8
                • MD5 SHA1 SHA512
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
                • Size 1KB
                • SHA256 b3a80cd7d0513d52183276ce966525962223dd326553d9473b0e174597b66b94
                • MD5 SHA1 SHA512
                Submit Download

                Cookies
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Cookies
                • Size 28KB
                • SHA256 50689921dec5daa501017f897a08d1b39a9ca2a95cb8ef53b60fd1ee0bbbb9ed
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Network Persistent State
                • Size 13KB
                • SHA256 232acdd11c82d57dcae839e4c3207e16f02212bb479557e5fb31635ae21945a4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Network Persistent State~RFe58c9d3.TMP
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Network Persistent State~RFe58c9d3.TMP
                • Size 59B
                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                • MD5 SHA1 SHA512
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
                • Size 3KB
                • SHA256 cb0b0df4d15ed2ca326fa2fa53e39a06f8aaf680213abb426a9a561b62eb89b0
                • MD5 SHA1 SHA512
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
                • Size 3KB
                • SHA256 6c88b053149bcdd48d69bc1045be3e54e65a62abab862c060c740a25bbba6a0e
                • MD5 SHA1 SHA512
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
                • Size 3KB
                • SHA256 4a854e21c640a0dfd2599200dc9b4986a1ee940e9f8703f0db95888577961f69
                • MD5 SHA1 SHA512
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
                • Size 3KB
                • SHA256 2e03534d45cdbfd73694e9ee80cbf984ae8c55db57950c5c98b9d8cec36d40dd
                • MD5 SHA1 SHA512
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
                • Size 3KB
                • SHA256 eacdf8df954461674bef213b86209e7a83454b2d9f720c7c0371ff5a0a1069c9
                • MD5 SHA1 SHA512
                Submit Download

                TransportSecurity~RFe580cbd.TMP
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity~RFe580cbd.TMP
                • Size 3KB
                • SHA256 bda5595f394ff2a39df56dfeaaaeec1922544e917d7db7bf424b0bf53f624ef6
                • MD5 SHA1 SHA512
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Session Storage\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\config.json
                • Size 140B
                • SHA256 dc4d87159e452383f6e39c1b7dd2830c69457a547565c43cfd9e9b86f336f336
                • MD5 SHA1 SHA512
                Submit Download

                memory/2344-3-0x00007FFC3F4A0000-0x00007FFC3F4A1000-memory.dmp
                Download

                memory/3128-526-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-517-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-518-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-519-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-524-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-523-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-525-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-528-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-527-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/3128-529-0x0000024711BA0000-0x0000024711BA1000-memory.dmp
                Download

                memory/4268-98-0x00007FFC3FF80000-0x00007FFC3FF81000-memory.dmp
                Download

                memory/4268-99-0x00007FFC3FA00000-0x00007FFC3FA01000-memory.dmp
                Download