Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 18:13
General
- Target GithubLauncher.exe
- Size 74.3MB
- Sample260705-wt8g3sey2x
- SHA256 cccf3b1f4115612f91af1a93d2a3c54e08b130405b855629470d33e40cc490c1
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GithubLauncher.exe"C:\Users\Admin\AppData\Local\Temp\GithubLauncher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\GithubLauncher_Updater.cmd""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "PID eq 2128"3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\find.exefind /I "2128"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /B "C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /I3⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Temp\GithubLauncher.exe"C:\Users\Admin\AppData\Local\Temp\GithubLauncher.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GitHubLauncher-v1.73-Windows.zip
GithubLauncher_Updater.cmd
GitHubLauncher.Core.pdb
GithubLauncher.dll.config
GithubLauncher.pdb
SDL2.dll
av_libglesv2.dll
libHarfBuzzSharp.dll
libSkiaSharp.dll
apps.json
settings.json
update_check.json
memory/2128-71-0x0000000016501000-0x0000000016540000-memory.dmp
memory/2128-3-0x0000000008CD1000-0x0000000008D07000-memory.dmp
memory/2128-14-0x0000000011651000-0x00000000116A7000-memory.dmp
memory/2128-15-0x00000000118D1000-0x0000000011A31000-memory.dmp
memory/2128-17-0x0000000013541000-0x00000000135C4000-memory.dmp
memory/2128-16-0x0000000013451000-0x000000001347C000-memory.dmp
memory/2128-18-0x00000000137C1000-0x0000000013961000-memory.dmp
memory/2128-12-0x0000000010381000-0x0000000010418000-memory.dmp
memory/2128-33-0x0000000071EF9000-0x0000000071EFA000-memory.dmp
memory/2128-36-0x0000000014501000-0x0000000014514000-memory.dmp
memory/2128-37-0x00000000148D1000-0x0000000014939000-memory.dmp
memory/2128-38-0x0000000014981000-0x0000000014996000-memory.dmp
memory/2128-41-0x0000000014B21000-0x0000000014B32000-memory.dmp
memory/2128-40-0x0000000014AC1000-0x0000000014AE2000-memory.dmp
memory/2128-47-0x0000000014EA1000-0x0000000014EC6000-memory.dmp
memory/2128-39-0x0000000014A61000-0x0000000014A72000-memory.dmp
memory/2128-50-0x00000000161D1000-0x00000000161D8000-memory.dmp
memory/2128-51-0x0000000016261000-0x0000000016268000-memory.dmp
memory/2128-53-0x0000000019991000-0x00000000199C4000-memory.dmp
memory/2128-2-0x0000000009381000-0x00000000093A0000-memory.dmp
memory/2128-73-0x0000000071DC0000-0x0000000071F09000-memory.dmp
memory/2128-11-0x000000000BAE1000-0x000000000BAE3000-memory.dmp
memory/2128-10-0x000000000B911000-0x000000000B98A000-memory.dmp
memory/2128-6-0x0000000001751000-0x000000000175E000-memory.dmp
memory/2128-8-0x00000000099A1000-0x00000000099D7000-memory.dmp
memory/2128-9-0x0000000009A21000-0x0000000009A40000-memory.dmp
memory/2128-7-0x0000000009901000-0x000000000990F000-memory.dmp
memory/2128-13-0x00000000112A1000-0x00000000112BA000-memory.dmp
memory/2128-4-0x0000000009781000-0x00000000097C0000-memory.dmp
memory/2128-5-0x0000000009801000-0x0000000009815000-memory.dmp
memory/2128-1-0x0000000009341000-0x000000000934D000-memory.dmp
memory/2128-0-0x0000000007841000-0x000000000855D000-memory.dmp
memory/6580-99-0x000000000B6A1000-0x000000000B6A3000-memory.dmp
memory/6580-101-0x000000000FF21000-0x000000000FFB8000-memory.dmp
memory/6580-95-0x00000000089C1000-0x00000000089F7000-memory.dmp
memory/6580-94-0x0000000008921000-0x000000000892F000-memory.dmp
memory/6580-90-0x0000000009501000-0x0000000009540000-memory.dmp
memory/6580-91-0x0000000009581000-0x0000000009595000-memory.dmp
memory/6580-89-0x0000000009331000-0x0000000009367000-memory.dmp
memory/6580-88-0x0000000008F41000-0x0000000008F60000-memory.dmp
memory/6580-87-0x0000000008F01000-0x0000000008F0D000-memory.dmp
memory/6580-97-0x000000000B4D1000-0x000000000B54A000-memory.dmp
memory/6580-96-0x00000000095E1000-0x0000000009600000-memory.dmp
memory/6580-103-0x0000000010E51000-0x0000000010E6A000-memory.dmp
memory/6580-93-0x0000000000961000-0x000000000096E000-memory.dmp
memory/6580-104-0x0000000011201000-0x0000000011257000-memory.dmp
memory/6580-105-0x00000000114A1000-0x0000000011601000-memory.dmp
memory/6580-107-0x00000000131C1000-0x00000000131EC000-memory.dmp
memory/6580-108-0x00000000132B1000-0x0000000013334000-memory.dmp
memory/6580-109-0x0000000013521000-0x00000000136C1000-memory.dmp
memory/6580-86-0x0000000007471000-0x000000000818D000-memory.dmp
memory/6580-131-0x00000000142F1000-0x0000000014316000-memory.dmp
memory/6580-133-0x0000000071DC0000-0x0000000071F09000-memory.dmp