Overview
overview
10Static
static
10Battly-Lau...ws.exe
windows7-x64
7Battly-Lau...ws.exe
windows10-2004-x64
7resources/...zip.js
windows7-x64
3resources/...zip.js
windows10-2004-x64
3resources/...der.js
windows7-x64
3resources/...der.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...der.js
windows7-x64
3resources/...der.js
windows10-2004-x64
3resources/...ter.js
windows7-x64
3resources/...ter.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...ter.js
windows7-x64
3resources/...ter.js
windows10-2004-x64
3resources/...pto.js
windows7-x64
3resources/...pto.js
windows10-2004-x64
3resources/...nts.js
windows7-x64
3resources/...nts.js
windows10-2004-x64
3resources/...ors.js
windows7-x64
3resources/...ors.js
windows10-2004-x64
3resources/...ttr.js
windows7-x64
3resources/...ttr.js
windows10-2004-x64
3resources/...tem.js
windows7-x64
3resources/...tem.js
windows10-2004-x64
3resources/...dex.js
windows7-x64
3resources/...dex.js
windows10-2004-x64
3resources/...ils.js
windows7-x64
3resources/...ils.js
windows10-2004-x64
3resources/...try.js
windows7-x64
3resources/...try.js
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 09:33
Behavioral task
behavioral1
Sample
Battly-Launcher-Windows.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Battly-Launcher-Windows.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
resources/app/node_modules/adm-zip/adm-zip.js
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
resources/app/node_modules/adm-zip/adm-zip.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
resources/app/node_modules/adm-zip/headers/entryHeader.js
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
resources/app/node_modules/adm-zip/headers/entryHeader.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
resources/app/node_modules/adm-zip/headers/index.js
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
resources/app/node_modules/adm-zip/headers/index.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
resources/app/node_modules/adm-zip/headers/mainHeader.js
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
resources/app/node_modules/adm-zip/headers/mainHeader.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
resources/app/node_modules/adm-zip/methods/deflater.js
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
resources/app/node_modules/adm-zip/methods/deflater.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
resources/app/node_modules/adm-zip/methods/index.js
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
resources/app/node_modules/adm-zip/methods/index.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
resources/app/node_modules/adm-zip/methods/inflater.js
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
resources/app/node_modules/adm-zip/methods/inflater.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
resources/app/node_modules/adm-zip/methods/zipcrypto.js
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
resources/app/node_modules/adm-zip/methods/zipcrypto.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
resources/app/node_modules/adm-zip/util/constants.js
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
resources/app/node_modules/adm-zip/util/constants.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
resources/app/node_modules/adm-zip/util/errors.js
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
resources/app/node_modules/adm-zip/util/errors.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
resources/app/node_modules/adm-zip/util/fattr.js
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
resources/app/node_modules/adm-zip/util/fattr.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
resources/app/node_modules/adm-zip/util/fileSystem.js
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
resources/app/node_modules/adm-zip/util/fileSystem.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
resources/app/node_modules/adm-zip/util/index.js
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
resources/app/node_modules/adm-zip/util/index.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
resources/app/node_modules/adm-zip/util/utils.js
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
resources/app/node_modules/adm-zip/util/utils.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
resources/app/node_modules/adm-zip/zipEntry.js
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
resources/app/node_modules/adm-zip/zipEntry.js
Resource
win10v2004-20240709-en
General
-
Target
Battly-Launcher-Windows.exe
-
Size
183.1MB
-
MD5
777dae8f41c5c9ba97b798fcd52612de
-
SHA1
03ec3ee7b1e1a47dc8b0e7f5f980ebd7071c469b
-
SHA256
a1941786149857faebfd4f2731022d8af6aaa984b981bffd40bd123472b0beb4
-
SHA512
792ccba986338f3a3d5475d615fa276a73c52eb483484ee2fda16a143f1100afdfd0dea2bb309bfba54202e07707df7bb025677f6477bf44ddb8f2282093f592
-
SSDEEP
3145728:qJcuNt6i+X0MdTUPo+YFawtU4odz5zA436E7IkGl0BkChNw5+VTmms+B6Q8k:ScuN7+QYFjmPz5zAJ0wahNw5+VTTs+Bl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Battly Launcher.exepid Process 2980 Battly Launcher.exe -
Loads dropped DLL 5 IoCs
Processes:
Battly-Launcher-Windows.exeBattly Launcher.exepid Process 2020 Battly-Launcher-Windows.exe 2020 Battly-Launcher-Windows.exe 2020 Battly-Launcher-Windows.exe 2020 Battly-Launcher-Windows.exe 2980 Battly Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Battly-Launcher-Windows.exedescription pid Process procid_target PID 2020 wrote to memory of 2980 2020 Battly-Launcher-Windows.exe 30 PID 2020 wrote to memory of 2980 2020 Battly-Launcher-Windows.exe 30 PID 2020 wrote to memory of 2980 2020 Battly-Launcher-Windows.exe 30 PID 2020 wrote to memory of 2980 2020 Battly-Launcher-Windows.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\Battly Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5bf09deeeb497aeddaf6194e695776b8b
SHA1e7d8719d6d0664b8746581b88eb03a486f588844
SHA256450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
SHA51238d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\ansi-styles\license
Filesize1KB
MD5915042b5df33c31a6db2b37eadaa00e3
SHA15aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA25648da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
SHA5129c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\node_modules\async\inject.js
Filesize4KB
MD5724bb52915e1158b4dff6f26ef4baf72
SHA1ad0aa6a0ac5576433051167524923e6aa794c96a
SHA256f1e4594194164d2504946c85c8e983346b25f9be8239178defec27e912b56c21
SHA512657c3dec82c5c6c34accdbc9d96e2be59a592e60241960810f10a662f5305c21dcef8cf006fcdefb0d48d30ccdd30d9dd6c263c089a88591f18a83a2f390eaaa
-
C:\Users\Admin\AppData\Local\Temp\2fejptRVqtuxOlbo01siOY8OCTG\resources\app\src\assets\js\index-es.js
Filesize33KB
MD5ca5f26a1bca7d0379bc07aa2196b9ae1
SHA1384fd58e544cdc1d246e0b5077ebc1fc8e77800e
SHA2567b84738f06f865a0bc533041e12acc8e2c651f153b8df96ca0a43956dddf20f9
SHA512ef19bb165a47de0625499919db32788f7ee8ba563210f525fa7db074b8521345a6e0bc35cf2d51daab7fcc9441dfbb8623f19b34b4ce3fcdd6f65c6173bdab35
-
Filesize
411KB
MD553b029ccb83951c0f232fbcde874b403
SHA1c6c57b8b7eac7c0f3b7ecff5d4b2a4c1de4d326f
SHA2564a3a74bcc1da624c51860bf3dc2333230cad7c961414e015a987e204f6447461
SHA512514d3e5e925ec16db2ab89d71b34c95ea76f5679dfc4fc2e759c0e982d08660b5ca9a76bbc814ed3335b461ac9e1bf82de2b88dc988f4378e3a974cd59485acb
-
Filesize
7KB
MD5487368e6fce9ab9c5ea053af0990c5ef
SHA1b538e37c87d4b9a7645dcbbd9e93025a31849702
SHA256e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
SHA512bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9