Analysis
- max time kernel
599s - max time network
470s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 15:52
General
- Target Paladium Games Launcher.exe
- Size 49.9MB
- Sample260622-tbf9rset5t
- SHA256 5b389befdbe4476163b6b316f28cd1281cf03444ae01f1994dfbcb6c1fda660e
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 29 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Paladium Games Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Paladium Games Launcher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C97LN.tmp\Paladium Games Launcher.tmp"C:\Users\Admin\AppData\Local\Temp\is-C97LN.tmp\Paladium Games Launcher.tmp" /SL5="$E020A,51500501,878080,C:\Users\Admin\AppData\Local\Temp\Paladium Games Launcher.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\Paladium Games Launcher.exe"C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\Paladium Games Launcher.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\jre\bin\javaw.exe"C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\jre\bin\javaw.exe" -version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\jre\bin\javaw.exe"C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\jre\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\Paladium Games Launcher.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /f /im jcef_helper.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\paladium-games\runtime\bin\javaw.exeC:\Users\Admin\AppData\Roaming\paladium-games\runtime\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\paladium-games\launcher.jar5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "if (([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)) { 'YES' } else { 'NO' }"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;$mypid = 4252;$skip = @('java.exe','javaw.exe','paladium.exe');for ($i = 0; $i -lt 5; $i++) { $proc = Get-CimInstance Win32_Process -Filter ('ProcessId=' + $mypid) -ErrorAction SilentlyContinue; if (-not $proc) { Write-Output ('[Walk] Level ' + $i + ' PID=' + $mypid + ' not found'); exit 1 }; Write-Output ('[Walk] Level ' + $i + ' PID=' + $mypid + ' Name=' + $proc.Name + ' Path=' + $proc.ExecutablePath); if ($proc.ExecutablePath) { if (-not ($skip -contains $proc.Name.ToLower())) { Write-Output ('[Walk] MATCH: ' + $proc.ExecutablePath); exit 0 }; if ($proc.ExecutablePath -match '\\(jre|runtime)\\bin\\javaw\.exe$') { try { $installDir = (Get-Item $proc.ExecutablePath).Directory.Parent.Parent.FullName; $candidate = Join-Path $installDir 'Paladium Games Launcher.exe'; Write-Output ('[Walk] Legacy bootstrap candidate: ' + $candidate); if (Test-Path $candidate) { Write-Output ('[Walk] MATCH: ' + $candidate); exit 0 } } catch { Write-Output ('[Walk] Legacy resolution error: ' + $_.Exception.Message) } } }; $mypid = $proc.ParentProcessId};Write-Output '[Walk] No match after 5 levels';exit 1"6⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $ErrorActionPreference = 'Stop'; try { $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Programs\Paladium Games Launcher\Paladium Games Launcher.exe'; $principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -RunLevel Highest -LogonType Interactive; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit (New-TimeSpan -Hours 0) -MultipleInstances Parallel; Register-ScheduledTask -TaskName 'PaladiumGamesLauncherElevated' -Action $action -Principal $principal -Settings $settings -Force | Out-Null; Write-Output '[ScheduledTask] Registered'; exit 0 } catch { Write-Output ('[ScheduledTask] Register failed: ' + $_.Exception.Message); exit 1 }"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
b841feb09084f0f8.timestamp
Paladium Games Launcher.exe
awt.dll
fontmanager.dll
java.dll
javaw.exe
management.dll
msvcr100.dll
net.dll
nio.dll
jvm.dll
sunec.dll
sunmscapi.dll
t2k.dll
verify.dll
zip.dll
accessibility.properties
jvm.cfg
meta-index
sunec.jar
sunjce_provider.jar
sunmscapi.jar
fontconfig.bfc
is-EPP7V.tmp
jce.jar
jsse.jar
meta-index
net.properties
resources.jar
blacklisted.certs
cacerts
java.security
US_export_policy.jar
local_policy.jar
tzdb.dat
tzmappings
__PSScriptPolicyTest_b1cqa4nc.ao0.ps1
Paladium Games Launcher.tmp
jar_cache6179311120764035133.tmp
jar_cache6235140197988505703.tmp
jar_cache7046039560610313278.tmp
launcher.jar
messages_zh_HK.properties
memory/1140-1041-0x000001627D770000-0x000001627D77A000-memory.dmp
memory/1140-1042-0x000001627DD20000-0x000001627DD4A000-memory.dmp
memory/1140-1040-0x000001627DA10000-0x000001627DAC2000-memory.dmp
memory/1140-1039-0x000001627D790000-0x000001627D7AE000-memory.dmp
memory/1140-1043-0x000001627DD20000-0x000001627DD44000-memory.dmp
memory/1768-708-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-986-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-649-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-653-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-1122-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-1120-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-665-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-560-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-680-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-821-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-910-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-985-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1768-704-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/2268-1031-0x0000025029960000-0x0000025029982000-memory.dmp
memory/3040-15-0x0000000000400000-0x000000000071F000-memory.dmp
memory/3040-515-0x0000000000400000-0x000000000071F000-memory.dmp
memory/3040-8-0x0000000000400000-0x000000000071F000-memory.dmp
memory/3040-9-0x0000000000400000-0x000000000071F000-memory.dmp
memory/3040-12-0x0000000000400000-0x000000000071F000-memory.dmp
memory/3040-304-0x0000000000400000-0x000000000071F000-memory.dmp
memory/3168-11-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/3168-0-0x00000000004C2000-0x00000000004C3000-memory.dmp
memory/3168-1-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/3168-518-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/4252-1074-0x0000000002050000-0x0000000002051000-memory.dmp
memory/4252-1055-0x0000000002050000-0x0000000002051000-memory.dmp
memory/4252-1036-0x0000000002050000-0x0000000002051000-memory.dmp
memory/4252-1100-0x0000000002050000-0x0000000002051000-memory.dmp
memory/4252-1102-0x0000000002050000-0x0000000002051000-memory.dmp
memory/4776-1051-0x0000012A69050000-0x0000012A69102000-memory.dmp
memory/4776-1052-0x0000012A69360000-0x0000012A6937E000-memory.dmp
memory/5632-530-0x0000000000400000-0x0000000000437000-memory.dmp
memory/6048-514-0x0000000002890000-0x0000000002B00000-memory.dmp
memory/6048-527-0x0000000002710000-0x0000000002711000-memory.dmp
memory/6048-528-0x0000000002890000-0x0000000002B00000-memory.dmp