Resubmissions
01/08/2026, 16:32
260801-t19ydas1fz401/08/2026, 16:27
260801-tx5t9a1amd401/08/2026, 16:13
260801-tn393azgmf4Analysis
- user interaction
yes - max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 16:27
General
- Target PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
- Size 22.8MB
- Sample260801-tx5t9a1amd
- SHA256 6c61bd9fef98c21750b021e0450896749cb25e75b91716bf22423d7ca64c1cb4
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 1 IoCs
- Modifies registry class 12 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe"C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe"1⤵
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TaskKill.exeTaskKill /IM prismlauncher.exe /F2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{FBA0939E-E18F-4731-9B31-811A47E55C0A}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{FBA0939E-E18F-4731-9B31-811A47E55C0A}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=776 -burn.filehandle.self=780 /install /passive /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6NetworkAuth.dll
Qt6OpenGL.dll
Qt6Widgets.dll
Qt6Xml.dll
archive.dll
bz2.dll
cmark.dll
icuuc.dll
liblzma.dll
lz4.dll
lzo2.dll
qwindows.dll
prismlauncher.exe
qrencode.dll
qt.conf
qtlogging.ini
qmodernwindowsstyle.dll
tomlplusplus-3.dll
vc_redist.x64.exe
zlib1.dll
zstd.dll
NScurl.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
logo.png
wixstdba.dll
vc_redist.x64.exe
memory/3132-219-0x00007FF7F43A0000-0x00007FF7F4CD5000-memory.dmp
memory/3132-215-0x00007FFB4C2A0000-0x00007FFB4C8E7000-memory.dmp
memory/5016-241-0x00007FFB49530000-0x00007FFB49B77000-memory.dmp
memory/5016-240-0x00007FF7F43A0000-0x00007FF7F4CD5000-memory.dmp
memory/5468-234-0x00007FFB49530000-0x00007FFB49B77000-memory.dmp
memory/5468-235-0x00007FF7F43A0000-0x00007FF7F4CD5000-memory.dmp
memory/5496-239-0x00007FF7F43A0000-0x00007FF7F4CD5000-memory.dmp
memory/5496-238-0x00007FFB49530000-0x00007FFB49B77000-memory.dmp
memory/5864-236-0x00007FF7F43A0000-0x00007FF7F4CD5000-memory.dmp
memory/5864-237-0x00007FFB49530000-0x00007FFB49B77000-memory.dmp
memory/5968-108-0x0000000073390000-0x00000000739A0000-memory.dmp
memory/5968-109-0x0000000073390000-0x00000000739A0000-memory.dmp
memory/5968-120-0x0000000073390000-0x00000000739A0000-memory.dmp