Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Launcher B...ue.exe
windows11-21h2-x64
3Launcher B...32.dll
windows11-21h2-x64
3Launcher Blue/cef.js
windows11-21h2-x64
3Launcher B...ons.js
windows11-21h2-x64
3Launcher B...le.dll
windows11-21h2-x64
3Launcher B...43.dll
windows11-21h2-x64
3Launcher B...47.dll
windows11-21h2-x64
3Launcher B...lp.dll
windows11-21h2-x64
3Launcher B...GL.dll
windows11-21h2-x64
3Launcher B...v2.dll
windows11-21h2-x64
3Launcher B...ef.dll
windows11-21h2-x64
3Launcher B...lob.js
windows11-21h2-x64
3Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/10/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
Launcher Blue/Launcher Blue.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Launcher Blue/PepperFlash/pepflashplayer32.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Launcher Blue/cef.js
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Launcher Blue/cef_extensions.js
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Launcher Blue/cefsimple.dll
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Launcher Blue/d3dcompiler_43.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Launcher Blue/d3dcompiler_47.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
Launcher Blue/dbghelp.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
Launcher Blue/libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
Launcher Blue/libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
Launcher Blue/libcef.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Launcher Blue/natives_blob.js
Resource
win11-20240802-en
General
-
Target
Launcher Blue/dbghelp.dll
-
Size
1.2MB
-
MD5
4003e34416ebd25e4c115d49dc15e1a7
-
SHA1
faf95ec65cde5bd833ce610bb8523363310ec4ad
-
SHA256
c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
-
SHA512
88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
-
SSDEEP
24576:9AkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9T:9WiOuRg/iyFzb2QN83XfeYaZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5768 wrote to memory of 1988 5768 rundll32.exe 78 PID 5768 wrote to memory of 1988 5768 rundll32.exe 78 PID 5768 wrote to memory of 1988 5768 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Launcher Blue\dbghelp.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Launcher Blue\dbghelp.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:1988
-