PrismLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PrismLauncher.exe
Size 1.8MB
Sample261023-2ay27avy3n
SHA256 9ced7e2ca051a96d906909eb647da66da7fe9b4ed80f97dd2d1f545519566fb7
MD5 cb613ecc72642ba44dc86f244e6308c1
SHA1 4bb380f6287b94f094f578df8451357ad4f1f313
SHA512 2fbe7fde045438eaecd313a47b0fc9410499cd836adac6ccaca9daf1ec9f17cd1ace7ad293872991aa03427803f11e116ec40a9b45b34d0e310d9ff0d63e53cd
SSDEEP 24576:pCtFFb2Kb/gyMAo26CLBPP6U8NXfiiG8nyh0lhSMXl3OJruAvCOmJGNtBsOq4Ms:pCtFFv/3to26CVX69tnvOcQmJgB1qL
TLSH
T1E5959D17B16182A4D05281788C62E763E7317C049F119EEB33D4AB693FF71E06EBA791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PrismLauncher.exe

File Explorer

PrismLauncher.exe

.exe 1.8MB

PrismLauncher.exe

IMPHASH ca75e0da53d357d08119b765878281e7
SHA256 9ced7e2ca051a96d906909eb647da66da7fe9b4ed80f97dd2d1f545519566fb7
MD5 cb613ecc72642ba44dc86f244e6308c1
SHA1 4bb380f6287b94f094f578df8451357ad4f1f313
SHA512 2fbe7fde045438eaecd313a47b0fc9410499cd836adac6ccaca9daf1ec9f17cd1ace7ad293872991aa03427803f11e116ec40a9b45b34d0e310d9ff0d63e53cd
SSDEEP 24576:pCtFFb2Kb/gyMAo26CLBPP6U8NXfiiG8nyh0lhSMXl3OJruAvCOmJGNtBsOq4Ms:pCtFFv/3to26CVX69tnvOcQmJgB1qL
TLSH
T1E5959D17B16182A4D05281788C62E763E7317C049F119EEB33D4AB693FF71E06EBA791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

799568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

winmm

PlaySoundW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree CoCreateInstance

shell32

SHGetKnownFolderPath SHCreateItemFromParsingName ShellExecuteW

advapi32

ConvertStringSidToSidW SetNamedSecurityInfoW SetEntriesInAclW RegGetValueW GetNamedSecurityInfoW

kernel32

GetFileAttributesW GetFileInformationByHandle GetStartupInfoW FindFirstFileExW FindFirstFileW InitializeSListHead FindClose CreateDirectoryW SizeofResource GetEnvironmentVariableW CreateMutexW OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW LockResource Process32FirstW CloseHandle LoadResource FindResourceW GetWindowsDirectoryW ExitProcess QueryFullProcessImageNameW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableA CreateFileW GetModuleHandleW WideCharToMultiByte ReadFile SetHandleInformation TerminateProcess CreatePipe WaitForSingleObject GetSystemDirectoryW GetLogicalDriveStringsW MultiByteToWideChar GetPackagesByPackageFamily GetFileAttributesExW FileTimeToSystemTime GetPackagePathByFullName FileTimeToLocalFileTime MoveFileExW CreateProcessW GetSystemTimeAsFileTime GetProcessTimes GetDriveTypeW GetExitCodeProcess GetCurrentDirectoryW Module32FirstW GetProcAddress VirtualAllocEx LocalFree RtlVirtualUnwind Module32NextW VirtualFreeEx LoadLibraryExW GetTickCount64 GetCurrentProcessId QueryUnbiasedInterruptTime GetCurrentProcess GetProcessId DuplicateHandle IsDebuggerPresent CheckRemoteDebuggerPresent GetSystemFirmwareTable GetFileSizeEx WriteFile ReadProcessMemory VirtualQuery FlushFileBuffers OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry FindNextFileW UnhandledExceptionFilter SetUnhandledExceptionFilter CreateRemoteThread IsProcessorFeaturePresent GetLocaleInfoEx FormatMessageA WriteProcessMemory

user32

CloseClipboard OpenClipboard LoadCursorA ClientToScreen SetCursor SetCursorPos GetClientRect IsWindowUnicode ReleaseCapture GetClipboardData GetCapture GetKeyState EmptyClipboard GetMessageExtraInfo TrackMouseEvent GetWindowThreadProcessId GetWindowTextLengthW IsWindowVisible SetForegroundWindow GetCursorPos UpdateWindow PostQuitMessage LoadCursorW SetClipboardData LoadImageW FindWindowW TranslateMessage SetCapture PeekMessageW GetMonitorInfoW DispatchMessageW ShowWindow IsIconic RegisterClassExW GetSystemMetrics ScreenToClient EnumWindows CreateWindowExW GetDpiForWindow MessageBoxA GetForegroundWindow DefWindowProcW MonitorFromPoint DestroyWindow MessageBoxW SetWindowPos

gdi32

CreateSolidBrush

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z _Mtx_unlock ??Bios_base@std@@QEBA_NXZ _Thrd_detach _Cnd_broadcast ??7ios_base@std@@QEBA_NXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$numpunct@D@std@@2V0locale@2@A _Xtime_get_ticks ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ _Thrd_join ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler __current_exception_context __current_exception strstr memset memmove _CxxThrowException memchr memcmp

api-ms-win-crt-stdio-l1-1-0

fputc ftell setvbuf fseek _wfopen fwrite __acrt_iob_func ungetc fsetpos fflush fread _fseeki64 _get_stream_buffer_pointers __p__commode fgetc fclose fgetpos __stdio_common_vswscanf _set_fmode __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-math-l1-1-0

cosf powf sinf sqrtf _ldclass expf floorf ceilf acosf _hypotf _fdclass _dclass fmodf _ldsign _fdsign _dsign lroundf roundf __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _beginthreadex abort _invoke_watson _errno

api-ms-win-crt-string-l1-1-0

isalpha isalnum _stricmp isdigit toupper islower _wcsnicmp isxdigit towlower strlen strncpy isupper strcmp _wcsicmp strncmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

strftime _localtime64_s

api-ms-win-crt-convert-l1-1-0

strtoull strtod strtoll atoi

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort