Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-es - resource tags
- submitted
20/06/2026, 00:54
General
- Target TLauncher-Installer-1.9.5.1.exe
- Size 25.5MB
- Sample260620-a9mpnady3v
- SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 1 IoCs
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-3054922120-1500138384-519748408-1000"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-3054922120-1500138384-519748408-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
200.ico
BrowserInstaller.exe
IRIMG1.BMP
IRIMG1.PNG
IRIMG10.PNG
IRIMG12.PNG
IRIMG13.PNG
IRIMG14.BMP
IRIMG14.PNG
IRIMG15.PNG
IRIMG17.PNG
IRIMG18.PNG
IRIMG2.BMP
IRIMG3.BMP
IRIMG3.PNG
IRIMG4.BMP
IRIMG4.PNG
IRIMG9.PNG
IRZip.lmd
Wow64.lmd
irsetup.exe
lua5.3.dll
irsetup.exe
lua5.3.dll
setuparguments.ini
TLauncher.exe
uninstall.xml
uninstall.xml
uninstall.xml
desktop.ini
memory/836-1345-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1503-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1478-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1462-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1420-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1418-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1412-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1405-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1403-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/836-1392-0x000001C60A050000-0x000001C60A051000-memory.dmp
memory/1824-1332-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2064-1338-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/2064-560-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/2064-1312-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/2064-650-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/2064-17-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/2064-1297-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/2064-565-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/2064-1140-0x0000000000DD0000-0x00000000013D1000-memory.dmp
memory/4204-660-0x0000000000DA0000-0x0000000001397000-memory.dmp
memory/4204-625-0x0000000000DA0000-0x0000000001397000-memory.dmp