Analysis
- max time kernel
151s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 22:31
General
- Target DandantankLauncherSetup.exe
- Size 46.5MB
- Sample260919-2fvlyscc36
- SHA256 42e2080db75d7ffb344f59ea91e650f9f8e71acfd2ff9f8ec1aaa46de3bb6453
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 23 IoCs
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DandantankLauncherSetup.exe"C:\Users\Admin\AppData\Local\Temp\DandantankLauncherSetup.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DandanLauncher\Dandantank Launcher.exe"C:\Program Files (x86)\DandanLauncher\Dandantank Launcher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DandanLauncher\CefSharp.BrowserSubprocess.exe"C:\Program Files (x86)\DandanLauncher\CefSharp.BrowserSubprocess.exe" --type=renderer --disable-gpu-compositing=1 --disable-gpu-vsync=1 --no-sandbox --primordial-pipe-token=33BF6AE74AC07EE070064866BF5332AD --lang=en-US --lang=tr --log-file="C:\Users\Admin\AppData\Local\DandantankLauncher\cef.log" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) DandantankLauncher/1.0 Chrome/63.0.3239.132 Safari/537.36" --enable-system-flash=1 --ppapi-flash-path="C:\Program Files (x86)\DandanLauncher\pepflashplayer.dll" --ppapi-flash-version=32.0.0.344 --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4844.0.372281114\2005501547" --mojo-platform-channel-handle=2548 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CefSharp.BrowserSubprocess.Core.dll
CefSharp.BrowserSubprocess.exe
CefSharp.Core.dll
CefSharp.WinForms.dll
CefSharp.dll
Dandantank Launcher.exe
Dandantank Launcher.exe.config
DiscordRPC.dll
MSVCP120.dll
MSVCR120.dll
Newtonsoft.Json.dll
cef.pak
cef_100_percent.pak
cef_200_percent.pak
cef_extensions.pak
devtools_resources.pak
icudtl.dat
libcef.dll
tr.pak
natives_blob.bin
snapshot_blob.bin
memory/1256-1-0x00000000004E0000-0x000000000335C000-memory.dmp
memory/1256-5-0x0000000007E00000-0x0000000007E12000-memory.dmp
memory/1256-195-0x0000000074870000-0x000000007502C000-memory.dmp
memory/1256-2-0x0000000008450000-0x0000000008A0A000-memory.dmp
memory/1256-0-0x0000000074882000-0x0000000074883000-memory.dmp
memory/1256-3-0x0000000007DD0000-0x0000000007DDA000-memory.dmp
memory/1256-175-0x0000000008B30000-0x0000000008B4E000-memory.dmp
memory/1256-174-0x0000000008010000-0x0000000008086000-memory.dmp
memory/1256-116-0x0000000074870000-0x000000007502C000-memory.dmp
memory/4844-193-0x0000000074870000-0x000000007502C000-memory.dmp
memory/4844-234-0x000000000AE70000-0x000000000AF20000-memory.dmp
memory/4844-212-0x0000000006540000-0x000000000654A000-memory.dmp
memory/4844-226-0x000000000A800000-0x000000000A80C000-memory.dmp
memory/4844-230-0x000000000A9E0000-0x000000000A9FA000-memory.dmp
memory/4844-211-0x00000000064F0000-0x000000000651E000-memory.dmp
memory/4844-199-0x0000000004EB0000-0x0000000004FD3000-memory.dmp
memory/4844-222-0x0000000074870000-0x000000007502C000-memory.dmp
memory/4844-235-0x000000000D1B0000-0x000000000D7C8000-memory.dmp
memory/4844-194-0x0000000004CC0000-0x0000000004D52000-memory.dmp
memory/4844-257-0x0000000074870000-0x000000007502C000-memory.dmp
memory/4844-192-0x00000000002A0000-0x00000000002AC000-memory.dmp
memory/4844-256-0x0000000074870000-0x000000007502C000-memory.dmp
memory/5944-244-0x0000000005650000-0x0000000005717000-memory.dmp
memory/5944-249-0x000000002C500000-0x000000002C501000-memory.dmp
memory/5944-238-0x0000000000D20000-0x0000000000D28000-memory.dmp