Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 04:09
General
- Target TLauncher-Installer-1.9.5.1.exe
- Size 25.5MB
- Sample260628-eq1vdse18m
- SHA256 0619bd07d3183a8ae0cb1be408c6ad32295d47ddd666b2d51edd4d5f5d211227
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 9 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3969818 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.5.1.exe" "__IRCT:3" "__IRTSS:26673860" "__IRSID:S-1-5-21-3246620872-1649211507-2285877732-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:3839250 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:3869932" "__IRSID:S-1-5-21-3246620872-1649211507-2285877732-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
200.ico
BrowserInstaller.exe
IRIMG1.BMP
IRIMG1.PNG
IRIMG10.PNG
IRIMG13.PNG
IRIMG14.PNG
IRIMG15.PNG
IRIMG17.PNG
IRIMG2.BMP
IRIMG3.BMP
IRIMG3.PNG
IRIMG4.BMP
IRIMG4.PNG
IRIMG9.PNG
IRZip.lmd
Wow64.lmd
irsetup.exe
lua5.3.dll
irsetup.exe
lua5.3.dll
setuparguments.ini
TLauncher.exe
uninstall.xml
uninstall.xml
uninstall.xml
uninstall.xml
desktop.ini
memory/1388-1348-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1437-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1471-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1462-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1443-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1435-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1385-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1304-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1375-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1361-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/1388-1370-0x0000019199CE0000-0x0000019199CE1000-memory.dmp
memory/4104-1434-0x000001A641B20000-0x000001A6421A0000-memory.dmp
memory/4104-1502-0x000001A641B20000-0x000001A6421A0000-memory.dmp
memory/4380-567-0x0000000000780000-0x0000000000D81000-memory.dmp
memory/4380-1295-0x0000000000780000-0x0000000000D81000-memory.dmp
memory/4380-11-0x0000000000780000-0x0000000000D81000-memory.dmp
memory/4380-584-0x0000000000780000-0x0000000000D81000-memory.dmp
memory/4380-1267-0x0000000000780000-0x0000000000D81000-memory.dmp
memory/6108-635-0x00000000008C0000-0x0000000000EB7000-memory.dmp
memory/6108-615-0x00000000008C0000-0x0000000000EB7000-memory.dmp
memory/6352-1292-0x0000000000400000-0x0000000000420000-memory.dmp