198cb8b4ac93307269d38ee15ef481dcf6b77b57c3a3aa7a6cbebc6195aa1751

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TLauncher-Installer-1.9.7.6.exe
Size 59.1MB
Sample260925-1bdbfaxy4q
SHA256 198cb8b4ac93307269d38ee15ef481dcf6b77b57c3a3aa7a6cbebc6195aa1751
MD5 3f8ee8ffac2dd0b0118f1d1854551d65
SHA1 80568509f975b6e4c3b1ace0a81fc29349837d00
SHA512 ef28a2c38fd462c3bfbbf04f9a9da431005421a63288c41ef154994c3229b6ea7bb30ddf8f18518d85dfc37dce8ee0068321e0de178a145e800647f357d55064
SSDEEP 1572864:OtpCBpx56Bu61eGv1pjg6pqPKJBZlCdwlS5ADYqM:eI6I61H5g6ImPgwkADYx
TLSH
T144D7333279A1C035D7B621319698E334EB7DED30AB3842A7A2D07D3C6F750C2567A25B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c550-5.dat	upx
behavioral2/memory/1352-11-0x0000000000A80000-0x0000000001081000-memory.dmp	upx
behavioral2/memory/1352-564-0x0000000000A80000-0x0000000001081000-memory.dmp	upx
behavioral2/memory/1352-575-0x0000000000A80000-0x0000000001081000-memory.dmp	upx
behavioral2/memory/1352-598-0x0000000000A80000-0x0000000001081000-memory.dmp	upx
behavioral2/memory/1352-599-0x0000000000A80000-0x0000000001081000-memory.dmp	upx
behavioral2/memory/1352-600-0x0000000000A80000-0x0000000001081000-memory.dmp	upx
behavioral2/memory/1352-601-0x0000000000A80000-0x0000000001081000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
1352	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
1352	irsetup.exe
1352	irsetup.exe
1352	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	irsetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	irsetup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher-Installer-1.9.7.6.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1352	irsetup.exe
1352	irsetup.exe
1352	irsetup.exe
1352	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1352	4156	TLauncher-Installer-1.9.7.6.exe	89

C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3938314 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.9.7.6.exe" "__IRCT:3" "__IRTSS:61981678" "__IRSID:S-1-5-21-1704430598-3087477806-3297458608-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

200.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Size 116KB
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
SSDEEP 1536:5HmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg:UfoZll0bGVmjWh
TLSH
T1C6C330260E6D3150D3992D79BEEAE3384E764D90EC6D21A314ED782AF9376EC13ED440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 12KB
SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
MD5 3adf5e8387c828f62f12d2dd59349d63
SHA1 bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA512 e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
SSDEEP 6:BlcgEMS0gjjjjjjjjjjjjjjjjjjjjjjjjjjj/naEMh:TcNwezg
TLSH
T192423A021F61C274F2CC0CA44D58244CEF10CA5B211B02C54C75073597C06D73EFB35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG2.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
Size 12KB
SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
MD5 f35117734829b05cfceaa7e39b2b61fb
SHA1 342ae5f530dce669fedaca053bd15b47e755adc2
SHA512 1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
SSDEEP 3:y9lMll2/l0uqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdC:BlcI
TLSH
T128420404113000D5D1450175007471C5751547D5D004034C30114C14451047703CC044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
Size 12KB
SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
MD5 f5d6a81635291e408332cc01c565068f
SHA1 72fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA512 33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
SSDEEP 3:y9lMll2/l0ZVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTn:BlcSj
TLSH
T1DA42040F110103C5D1C700350C57C1C4F51F45357004035C1011CC344D10457034C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG7.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.PNG
Size 438B
SHA256 5252a4f2519c4c215a7d82ee5f2fe5752ed9604fcf5bf90cc98af1448faf881b
MD5 f471fdd8d35b0dad41b6138d6529bee5
SHA1 d2a3c9f4d6a40f4fc74a5f1645390ad8ad169ef1
SHA512 864d74cecf4e24cecea5b3e2024e0832fae56f6c7397b4fda30502b3645b9c25187c2a8019a0c6d0eb0f7ba3f41b9b5ed8400eb29b97bb4bf637554c2643ad3e
TLSH
T1E2F05CC22E547AA0C50F6632DE194686912664C72DB97359EC15D6213390BC6A15A1B2
MD5 SHA1 SHA512 TLSH

Submit Download

IRZip.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Size 400KB
SHA256 4776d4c121e2294f1e6bca5a89525e4a451190c218244a1e34bcbf9f65b18fa5
MD5 a104fd7978c81c831f03eb8fd23fc5e4
SHA1 7643f972054f54c7856b40a9509b32e0ab52eca6
SHA512 95193fa53a18c5bfae845b6ae8a2e43da2f1bb81e98ea80ffe57113ac12826701cc84e52ed0d57f9ebb10a7281e4f8f6ea435269ec8c5688c34e09ec4e8b8d3e
SSDEEP 12288:/wji6+ZoE2oaXKOAilmVx+igEpONKiKjZTesV4:EiJTbaXlAUnKiKjJesV4
TLSH
T1D1949D01B6C1C0B2D1AD253124AAA3369A3E7D205735D7C3F79CFA7A5F311D1AA2934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TL-INSTALLER.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\TL-INSTALLER.exe
Size 3.8MB
SHA256 b6c92b1826f3804c40db9b2adb0350ffc5eec8ce914c6435d0d9b09d34ebad71
MD5 917ba16d5b92e01a23a255fb44c1edd4
SHA1 39c699c578b5f18344fa91f4d07eda2b7fb06a39
SHA512 18975f605ccc178841919b1db2937a5c69c4164ed8f0848a01e69a316aa74eee6ff7529d9bb6d2d8f7d7bedabf75cad6e03de3147b706682049bd33b01641b55
SSDEEP 98304:xnAQff5+yN0EDi026vPOLGxJJJG65Cvuqa5oM+1XvtzYvwUKxRXsH9wVz:xL5T1PpJy65CvuH9IvVR8H9wd
TLSH
T11006F1357AA2C072D73232309699A37AE7BDB9309B7552D726D01D3C2E705C2993836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wow64.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Size 252KB
SHA256 27b48727237cd0f8a1205e01e5c93cbe6c7a2f3938faf8d8daa5191094c347a5
MD5 bfa121019a2dd9f7749f6bb72570319e
SHA1 fc48a96ad45e00815060bb366fe8f31c140ecb19
SHA512 cda75a55119104b23489b1048c810e066099b13e12aade7cfc757ba91de7b6754edff2da561741a16c92aa00d7e4ea0b53f77ebea6aaca059a74847a0f5d4059
SSDEEP 3072:52E6GukcxWtnwkwNBp0AUTjQzKgvyVx9QlllMS25RpaLSDk/wY:52EcxW2kwNBp5UTsKgaQllaMLl
TLSH
T15F444B0176C4C032D27B21354877D375AA7ABD618BB48287BBDCAA7B5F705C28A37316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.7MB
SHA256 81b2e287246cfa5dea40c9589ac32406a4b65f593cae31d65034551399b4be2e
MD5 e67da3b0caa1d3a99ce46749a101da5b
SHA1 67e98ffba4b5abfd333f8ae53a2e816215936e94
SHA512 9ce98ae60dd094b3eb1b384f5fbaf27591d5f88f8420cf4182a4cff91792f31ff2d855e144779a918bcb169257b81e3ecb8e6e892b82419befd165b9fc187e1d
SSDEEP 49152:KsH0f+1+uvv0E6Y3ZzMDRFwchKxRnrDAvn/V40:TM+1XvtzYvwUKxRXsD
TLSH
T1E7853391EEC0DA84C05C8AB0523687152172BE02F5DE1D0782A4B64F5EBBBDFDD26772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 395KB
SHA256 22eb6f08accb3c20caa7a7240aa094467204918d2a797b5c6905bea3f2361677
MD5 bfb686060b227113dcfb04026a6d4b1a
SHA1 c50c21b067993906f3f2c7193d95e265410eab49
SHA512 593996b709194a7e58d14b0232d0d4ef86b2adcb88177a48206b30a47730a7ad514752cff4e559dee5aebeec4fa58a5e348ed02b646c508166b4114052270cb8
SSDEEP 12288:J3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pUVh:QaLbwKLDTH5+6pUVh
TLSH
T1DE84BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1352-575-0x0000000000A80000-0x0000000001081000-memory.dmp

Download

memory/1352-564-0x0000000000A80000-0x0000000001081000-memory.dmp

Download

memory/1352-11-0x0000000000A80000-0x0000000001081000-memory.dmp

Download

memory/1352-598-0x0000000000A80000-0x0000000001081000-memory.dmp

Download

memory/1352-599-0x0000000000A80000-0x0000000001081000-memory.dmp

Download

memory/1352-600-0x0000000000A80000-0x0000000001081000-memory.dmp

Download

memory/1352-601-0x0000000000A80000-0x0000000001081000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads