d051b434836408a72c8b8d9be423c30bf51cef3df2f954b5b099740954845ccd

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ATLauncher-setup-1.2.0.0.exe
Size

2.6MB
MD5

9515a0d3a9dfa2c861baee86ee447419
SHA1

6fa7b3341f3fa7d9bd38a194c80ae8077e842524
SHA256

d051b434836408a72c8b8d9be423c30bf51cef3df2f954b5b099740954845ccd
SHA512

ca8fb4775c3c08220e356e44c0b8fd304d7264cd6aa2a924ebf8d4170e53cd5db25fc2460f52f0a6fcdfa4305340d555c7b9ff4bd300ffb2b5ae288bc6b9d8e9
SSDEEP

49152:NBuZrEUp9VRG26qhJQrstMU9QbKzjgZTUljEXSD:bkLp9Vk2z0J2Qez8IjECD

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2544	ATLauncher-setup-1.2.0.0.tmp

Loads dropped DLL 1 IoCs

pid	Process
1956	ATLauncher-setup-1.2.0.0.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATLauncher-setup-1.2.0.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATLauncher-setup-1.2.0.0.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	ATLauncher-setup-1.2.0.0.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2544	1956	ATLauncher-setup-1.2.0.0.exe	30
PID 1956 wrote to memory of 2544	1956	ATLauncher-setup-1.2.0.0.exe	30
PID 1956 wrote to memory of 2544	1956	ATLauncher-setup-1.2.0.0.exe	30
PID 1956 wrote to memory of 2544	1956	ATLauncher-setup-1.2.0.0.exe	30
PID 1956 wrote to memory of 2544	1956	ATLauncher-setup-1.2.0.0.exe	30
PID 1956 wrote to memory of 2544	1956	ATLauncher-setup-1.2.0.0.exe	30
PID 1956 wrote to memory of 2544	1956	ATLauncher-setup-1.2.0.0.exe	30

C:\Users\Admin\AppData\Local\Temp\ATLauncher-setup-1.2.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\ATLauncher-setup-1.2.0.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\is-9H6VO.tmp\ATLauncher-setup-1.2.0.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9H6VO.tmp\ATLauncher-setup-1.2.0.0.tmp" /SL5="$701AE,1526961,1202688,C:\Users\Admin\AppData\Local\Temp\ATLauncher-setup-1.2.0.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-9H6VO.tmp\ATLauncher-setup-1.2.0.0.tmp

Filesize
3.4MB

MD5
fddfc2fd95d94fcc4f4c3d3abc482dd7

SHA1
c82ffaf7f1972222de8e260f009f746cba33554b

SHA256
5b15c5d2b573d06a78b1774a6b5ed549fef9eace60b1b137f5186a3dac25ab68

SHA512
ab316f9da61b552d1f11e4873d228c35cc091846530297dfd3c2d2fd3a971d42406ee58f8969538e8046eb111a3e3e0c63017e97cb9f9eafe4ff04b703698152

Download Submit
memory/1956-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1956-0-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/1956-10-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2544-8-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download
memory/2544-11-0x0000000000400000-0x0000000000776000-memory.dmp

Filesize
3.5MB

Download