Analysis
- user interaction
yes - max time kernel
64s - max time network
58s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 08:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Technic Launcher.exe
Resource
win10v2004-20260513-en
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
Technic Launcher.exe
Resource
win11ltsc2024-20260709-en
3 signatures
900 seconds
General
- Target Technic Launcher.exe
- Size 2.2MB
- Sample260820-kqpd9atamd
- SHA256 473511ad7cebe2ca1721f9f54693292e8262a232a0bf3bb02c2cf43ce4afd7ab
- MD5 27c32513a24af5239e7955390755c062
- SHA1 0fe8b480c3b9027d2893e0277baab5b86fa4a5bf
- SHA512 0d1dba063c600ff04b95a37bec31e6518edcebe80b1a4625d94ddcd41ba2cb9870fe7c2e4bdd276bf8bfc32b3aca2247fee47886d5b218f670b06d93f2c46609
- SSDEEP 49152:GZx1HuQo1axh73PD5/woy+hivD52fFkUflOmr4wchlR7gJqZEiX:GZx8Qo1gDy+wd2dNl+JyiX
- TLSH T116B50256FDE2D459F10F80F130B6CC23692C618DD286B2A785A402CACDA7DD51B4FADE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Technic Launcher.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3520 javaw.exe 3520 javaw.exe 3520 javaw.exe 3520 javaw.exe 3520 javaw.exe 3520 javaw.exe 3520 javaw.exe 3520 javaw.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3824 wrote to memory of 3520 3824 Technic Launcher.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Technic Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Technic Launcher.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\Technic Launcher.exe;anything" org.spoutcraft.launcher.entrypoint.Start2⤵
- Suspicious use of SetWindowsHookEx
PID:3520
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\+~JF3940093294662260629.tmp
- Size 17KB
- SHA256 9e1065577a8b8ff07301192cf61dc7f3f457e775704a50c44721fc3be42c4b62
- MD5 16c5d52a71debfb97540d8d490f00389
- SHA1 a3350fbde480b69bcb8785b67ebcf312d6491601
- SHA512 b4eab6b32ba1236049b82fd63d3c666cbf1945ecae2d2be6826242992c90e617b4999b714609d3f3e6d4ec3e51d17a1a4adc7c98696a146da5533080e08f3c8c
- SSDEEP 384:l3snCAChfU6NQodoKcpD6amqGwVAvUVbk/Xw3caJ2g3yOUV+upD:2JCBU6NjvcpD6aFGwV7VbyA3cA2AyOUJ
- TLSH T17182C68255F18602FC1336B88D6F5B445EE96A835EA1D38363BA3C680CD9BC5BE573C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\+~JF4602269690289621644.tmp
- Size 65KB
- SHA256 bb060d319ec18d16e7b26dcf719759b0f0d30dcd9610ae4a9bb7dd31642b96da
- MD5 da61171a6b1b3694ab78996c96c6126a
- SHA1 e72e97bd4e41dccb3e18efbab2039cd8f41aa0b4
- SHA512 7b84300a7f24691690405d7258b9e72c12593c4a3c7285102a741dbd84a64344ce65c4b8099cfcd4c4c3dc934203e3084f73cbd50780ae28a3aaafa009750628
- SSDEEP 1536:5nsTUeJ3igVW5c/Qdk2E8H7O1j7JI6ZL3Uw0:Wg0ign/Qdk2E8H7O1j7a6BkZ
- TLSH T14E637C519393444AE2F22F3D86721301A57AF231EF57539F1A3C453B588E2A4DCA72EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\imageio2226695622247480912.tmp
- Size 489B
- SHA256 ddb122ca7395d24c38e88dbcbb1be2857881d70c6e5770221bf2e942cbb71e14
- MD5 02c5eff025f17c62d2410a34c3e753e2
- SHA1 b2efde058a60078d2ed6febe34c139bf5795626b
- SHA512 9335ccd0dc359ac8c3e914523768adaba2d30f03160e761c16d804be97a05ffeb37dcc380fce1ec021672a4a3a81153789d60433759154de0cda8ecaf7599f8a
- TLSH T148F0AB5AD7C88DADD44F413C2B832DE0C4B946808CD24B0DF7C2906445A35C39506F0D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\imageio3060269412724114746.tmp
- Size 48KB
- SHA256 7727bd6f77f3b0e0ad140fcdb3fce81f37aab149d7b099e76cf8c03fef44b65d
- MD5 71135c61abdac492c7a227e8f0d8b799
- SHA1 df371def6b85062d9630c0e9105982675de0e128
- SHA512 57a24f45ada852fc0e8f7b536f220e49cd1cbf7c5ca697a143752bbc4de115f765e9b765374974e0335d32fe196d0f51c0c533158f0177b73aca41fa68307f9a
- SSDEEP 768:lY9muRof8oYP5Ga/jqNcTtRXWz/o26aDw2fSG6K3rVxrHtUesyDwsMjy62hUzu0o:lYMP8oYPEj2BRXYDMKBpNUeBF/UzcD
- TLSH T1D523F1676301720FE98C1E71A9FB690BED220930BEC54D8FB579918245B162BBF9C05E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\imageio6581828880932131123.tmp
- Size 3KB
- SHA256 e4395525b4e1a556f253a59d6a4d25ac9d4fd2865ce47cdca0d6558831ab02eb
- MD5 40a95f16badb53a43446f6bf2912f565
- SHA1 b98487fe32e5b6cc89ec477490b32493d17e4b5f
- SHA512 10970c7848e54a0490087d642aeb52776601ab0f5c8164f8be932f3b6ae2117bd858a0af417aeb95eebfdd41b6e3a8adc00b3250a76ebfa32905054b5d6e9340
- TLSH T185718EAFC42078EEBC5D36114CED4101DB94125CE79D353D51E1DADE0499D477B62021
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\.technic\installedPacks
- Size 1KB
- SHA256 a27e73bf490c715fb20b0e8881c67941e669c7e0f26e590e282fea30264be18b
- MD5 7ec4d68769cbe9db210c8fc088b97464
- SHA1 4cd7e0321df0cd35f83784ad4eade68dc74fb043
- SHA512 138c075452d3768d78c5674e31e4c0c2f063ee2b2257e301af5b8c6dff9ead5433b7f493736f9e6c6a1b835518ec846ede80a063fb4807040656196389f3950d
- TLSH T11F31D626C5FA6CA31A6990864D790193603040BB0D2C7D6CB34D09EC5F1EB4E51BDB9F
- MD5 SHA1 SHA512 TLSH