473f014069f7db63c4d9c1bec76e790adad169862cc6e338f0b36a7824a724a4

Analysis

max time kernel
180s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TLauncher-Installer-1.9.7.6.0.exe
Size 59.1MB
Sample260831-kaevwafd43
SHA256 473f014069f7db63c4d9c1bec76e790adad169862cc6e338f0b36a7824a724a4
MD5 02a406a7931c72ddf0be8ad6e7ebf3e9
SHA1 734428238f5744e29cf73e2d482fc113bcfdfb15
SHA512 a2af9a6223e3505f0c43882601b124d1ef5b44d56a4b07a26c72b4a1132a4931c78e271d1cd4f918f400c6d35e84dcfaa6d1e3dc70cc9eead82e4b2045b6f273
SSDEEP 1572864:MtpntBpx56Bu61eGv1pjg6pqPKJBZlCdwlS5ADYqI:YX6I61H5g6ImPgwkADY3
TLSH
T19AD7333279A28035D77231359698E334EB7DED30AB3841A7A2D07D3C6F760C2567A25B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c575-5.dat	upx
behavioral2/memory/2680-11-0x0000000000070000-0x0000000000671000-memory.dmp	upx
behavioral2/memory/2680-552-0x0000000000070000-0x0000000000671000-memory.dmp	upx
behavioral2/memory/2680-575-0x0000000000070000-0x0000000000671000-memory.dmp	upx
behavioral2/memory/2680-590-0x0000000000070000-0x0000000000671000-memory.dmp	upx
behavioral2/memory/2680-599-0x0000000000070000-0x0000000000671000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
2680	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
2680	irsetup.exe
2680	irsetup.exe
2680	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher-Installer-1.9.7.6.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2680	irsetup.exe
2680	irsetup.exe
2680	irsetup.exe
2680	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2680	2520	TLauncher-Installer-1.9.7.6.0.exe	89

C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.0.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3938314 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.0.exe" "__IRCT:3" "__IRTSS:61979963" "__IRSID:S-1-5-21-2115213192-531537726-3295841909-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

200.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Size 116KB
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
SSDEEP 1536:5HmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg:UfoZll0bGVmjWh
TLSH
T1C6C330260E6D3150D3992D79BEEAE3384E764D90EC6D21A314ED782AF9376EC13ED440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 12KB
SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
MD5 3adf5e8387c828f62f12d2dd59349d63
SHA1 bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA512 e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
SSDEEP 6:BlcgEMS0gjjjjjjjjjjjjjjjjjjjjjjjjjjj/naEMh:TcNwezg
TLSH
T192423A021F61C274F2CC0CA44D58244CEF10CA5B211B02C54C75073597C06D73EFB35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG2.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
Size 12KB
SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
MD5 f35117734829b05cfceaa7e39b2b61fb
SHA1 342ae5f530dce669fedaca053bd15b47e755adc2
SHA512 1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
SSDEEP 3:y9lMll2/l0uqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdC:BlcI
TLSH
T128420404113000D5D1450175007471C5751547D5D004034C30114C14451047703CC044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
Size 12KB
SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
MD5 f5d6a81635291e408332cc01c565068f
SHA1 72fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA512 33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
SSDEEP 3:y9lMll2/l0ZVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTn:BlcSj
TLSH
T1DA42040F110103C5D1C700350C57C1C4F51F45357004035C1011CC344D10457034C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG7.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.PNG
Size 438B
SHA256 689e9d4a7000acc037855bda9afae63aba008ca2b857eaf55b447233a3493cf8
MD5 b6940c5655e48e03216a99f5a0044496
SHA1 4766207324162fbea2ffb9181c8cec8ad6fdd611
SHA512 dc3e89d177d4fcd93bbbfc7ffbe29e613a489f7c47651afc4385dd99d001f726e382a70f8bf6421107db408ebeb57739966849755de32f8545d3a3e5c3f045bd
TLSH
T1EEF023C21F907AA0C50F2732DE5D4A4B812364C73DFA336ADC15DB213390BC6A0561F2
MD5 SHA1 SHA512 TLSH

Submit Download

IRZip.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Size 400KB
SHA256 4776d4c121e2294f1e6bca5a89525e4a451190c218244a1e34bcbf9f65b18fa5
MD5 a104fd7978c81c831f03eb8fd23fc5e4
SHA1 7643f972054f54c7856b40a9509b32e0ab52eca6
SHA512 95193fa53a18c5bfae845b6ae8a2e43da2f1bb81e98ea80ffe57113ac12826701cc84e52ed0d57f9ebb10a7281e4f8f6ea435269ec8c5688c34e09ec4e8b8d3e
SSDEEP 12288:/wji6+ZoE2oaXKOAilmVx+igEpONKiKjZTesV4:EiJTbaXlAUnKiKjJesV4
TLSH
T1D1949D01B6C1C0B2D1AD253124AAA3369A3E7D205735D7C3F79CFA7A5F311D1AA2934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TL-INSTALLER.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\TL-INSTALLER.exe
Size 3.8MB
SHA256 b6c92b1826f3804c40db9b2adb0350ffc5eec8ce914c6435d0d9b09d34ebad71
MD5 917ba16d5b92e01a23a255fb44c1edd4
SHA1 39c699c578b5f18344fa91f4d07eda2b7fb06a39
SHA512 18975f605ccc178841919b1db2937a5c69c4164ed8f0848a01e69a316aa74eee6ff7529d9bb6d2d8f7d7bedabf75cad6e03de3147b706682049bd33b01641b55
SSDEEP 98304:xnAQff5+yN0EDi026vPOLGxJJJG65Cvuqa5oM+1XvtzYvwUKxRXsH9wVz:xL5T1PpJy65CvuH9IvVR8H9wd
TLSH
T11006F1357AA2C072D73232309699A37AE7BDB9309B7552D726D01D3C2E705C2993836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wow64.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Size 252KB
SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
MD5 bfa121019a2dd9f7749f6bb72570319e
SHA1 fc48a96ad45e00815060bb366fe8f31c140ecb19
SHA512 cda75a55119104b23489b1048c810e066099b13e12aade7cfc757ba91de7b6754edff2da561741a16c92aa00d7e4ea0b53f77ebea6aaca059a74847a0f5d4059
SSDEEP 3072:52E6GukcxWtnwkwNBp0AUTjQzKgvyVx9QlllMS25RpaLSDk/wY:52EcxW2kwNBp5UTsKgaQllaMLl
TLSH
T15F444B0176C4C032D27B21354877D375AA7ABD618BB48287BBDCAA7B5F705C28A37316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.7MB
SHA256 7588e5adcec0aad47decc6e14d0db4256cba00ddadbd9ab7427722f7ef34aa60
MD5 d453bac9dfc609c93873b6a262b05511
SHA1 22b52f293af434f60770b4eb4602099604b8081a
SHA512 feaeaea87c3a1afbc91242fdbb8d0b571d2022a843d00c752cb7b0c9bf39e4034eea1ef2a9f029bd3f0ce02a8b11d18eff950aa5bcaed972c20ef20e38775e7e
SSDEEP 49152:GsH0f+1+uvv0E6Y3ZzMDRFwchKxRnrDAvn/V4Q:HM+1XvtzYvwUKxRXsP
TLSH
T158853391EEC0DA84C05C4AB0523687152172BE02F5DE1D0782A4B64F5EBBBCFDD66772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 395KB
SHA256 22eb6f08accb3c20caa7a7240aa094467204918d2a797b5c6905bea3f2361677
MD5 bfb686060b227113dcfb04026a6d4b1a
SHA1 c50c21b067993906f3f2c7193d95e265410eab49
SHA512 593996b709194a7e58d14b0232d0d4ef86b2adcb88177a48206b30a47730a7ad514752cff4e559dee5aebeec4fa58a5e348ed02b646c508166b4114052270cb8
SSDEEP 12288:J3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pUVh:QaLbwKLDTH5+6pUVh
TLSH
T1DE84BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2680-552-0x0000000000070000-0x0000000000671000-memory.dmp

Download

memory/2680-11-0x0000000000070000-0x0000000000671000-memory.dmp

Download

memory/2680-575-0x0000000000070000-0x0000000000671000-memory.dmp

Download

memory/2680-590-0x0000000000070000-0x0000000000671000-memory.dmp

Download

memory/2680-599-0x0000000000070000-0x0000000000671000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads