cf744e24c831f510b4260d5bb089e64545e4e4c0b1b8bc798c0bd7e110fe150b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TLauncher-Installer-1.8.7.exe
Size 25.4MB
Sample261102-bacabazsfs
SHA256 cf744e24c831f510b4260d5bb089e64545e4e4c0b1b8bc798c0bd7e110fe150b
MD5 0659c3a7f26549abc27157ec17be7459
SHA1 52458aed8a77436a28872a719ddc247c36db61d8
SHA512 8e2330334e890a7cee9cb715d149b1c7c0bb169c780bd704714058df987cb87a13ba972aac38ae8c5fcdb2424dd0ec1a5f52f9aa7199f2aebcc8eafa3c731c8d
SSDEEP 786432:GobfYCulQ6W1RrrKJBH5lFRqeYdj7srKOJI+N1SF71:GobQoTbPKJBZlCWKwfPSFR
TLSH
T1B14733267AB2C071C77236345A99A334F6BEAC30AB3845D366903D3D6E711D19A3C35B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4c4-4.dat	upx
behavioral2/memory/4124-12-0x0000000000DF0000-0x00000000013E7000-memory.dmp	upx
behavioral2/memory/4124-567-0x0000000000DF0000-0x00000000013E7000-memory.dmp	upx
behavioral2/memory/4124-584-0x0000000000DF0000-0x00000000013E7000-memory.dmp	upx
behavioral2/memory/4124-605-0x0000000000DF0000-0x00000000013E7000-memory.dmp	upx
behavioral2/memory/4124-618-0x0000000000DF0000-0x00000000013E7000-memory.dmp	upx
behavioral2/memory/4124-620-0x0000000000DF0000-0x00000000013E7000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4124	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
4124	irsetup.exe
4124	irsetup.exe
4124	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	irsetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	irsetup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher-Installer-1.8.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4124	irsetup.exe
4124	irsetup.exe
4124	irsetup.exe
4124	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4124	3356	TLauncher-Installer-1.8.7.exe	89

C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.8.7.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.8.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3933458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.8.7.exe" "__IRCT:3" "__IRTSS:26632673" "__IRSID:S-1-5-21-2304238888-3968896904-642854331-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

200.ico

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
Size 116KB
SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
MD5 e043a9cb014d641a56f50f9d9ac9a1b9
SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
SSDEEP 1536:5HmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg:UfoZll0bGVmjWh
TLSH
T1C6C330260E6D3150D3992D79BEEAE3384E764D90EC6D21A314ED782AF9376EC13ED440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
Size 3.7MB
SHA256 e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10
MD5 05db02530acae561d2e4b368ccd45f52
SHA1 050101d4689ee8012bcf7eff4cdbe15a3851ecc8
SHA512 8a3e37e6d5e73fdac7f4b974dd350011b83b410b2b26b140bb53f1c497d3fea857c9ecf03e931dba53908eeada1859d4f3797f47d187d84e651b1fa42f548b37
SSDEEP 98304:DLDSCHji8v64cym9lYQre8JVal0S8R4+h8GdspyRLndhyOu9w:DHfQbVTS8R4E8GduAT89w
TLSH
T15906F12A7A72C072C6323630969DA379E6BDB8705B35829317D01E3D2E715D2993C36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 12KB
SHA256 1d7a67b1c0d620506ac76da1984449dfb9c35ffa080dc51e439ed45eecaa7ee0
MD5 3adf5e8387c828f62f12d2dd59349d63
SHA1 bd065d74b7fa534e5bfb0fb8fb2ee1f188db9e3a
SHA512 e4ceb68a0a7d211152d0009cc0ef9b11537cfa8911d6d773c465cea203122f1c83496e655c9654aabe2034161e132de8714f3751d2b448a6a87d5e0dd36625be
SSDEEP 6:BlcgEMS0gjjjjjjjjjjjjjjjjjjjjjjjjjjj/naEMh:TcNwezg
TLSH
T192423A021F61C274F2CC0CA44D58244CEF10CA5B211B02C54C75073597C06D73EFB35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG2.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMP
Size 12KB
SHA256 9c893fe1ab940ee4c2424aa9dd9972e7ad3198da670006263ecbbb5106d881e3
MD5 f35117734829b05cfceaa7e39b2b61fb
SHA1 342ae5f530dce669fedaca053bd15b47e755adc2
SHA512 1805b376ab7aae87061e9b3f586e9fdef942bb32488b388856d8a96e15871238882928c75489994f9916a77e2c61c6f6629e37d1d872721d19a5d4de3e77f471
SSDEEP 3:y9lMll2/l0uqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdqdC:BlcI
TLSH
T128420404113000D5D1450175007471C5751547D5D004034C30114C14451047703CC044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMP
Size 12KB
SHA256 4c85cdddd497ad81fedb090bc0f8d69b54106c226063fdc1795ada7d8dc74e26
MD5 f5d6a81635291e408332cc01c565068f
SHA1 72fa5c8111e95cc7c5e97a09d1376f0619be111b
SHA512 33333761706c069d2c1396e85333f759549b1dfc94674abb612fd4e5336b1c4877844270a8126e833d0617e6780dd8a4fee2d380c16de8cbf475b23f9d512b5a
SSDEEP 3:y9lMll2/l0ZVTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTn:BlcSj
TLSH
T1DA42040F110103C5D1C700350C57C1C4F51F45357004035C1011CC344D10457034C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG9.PNG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG
Size 438B
SHA256 a1879ca46e73ccfdbf49a29f9842bd7fd915135f03f24aede99cba77cbc74bfb
MD5 ba783533ce7f78956091077c1a94ed3a
SHA1 f4ad30df6bbe8bd78081ea39622b914de9fbd788
SHA512 2b3ae55fb10f51321ed268a19a02e6a1737a078a5dd021e4bdca07b109f442681e944ede8d2aa51b96000158f2a08f9f4a2883e603573c43c36a00ffb997a7e3
TLSH
T13EF0DCC61E547AA0C50F2732DE1A4646912254C72CF933699804D6213380BC6A0461E2
MD5 SHA1 SHA512 TLSH

Submit Download

IRZip.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
Size 400KB
SHA256 f689e210358131689837a33dc5702971f6964b2b66e88e98339dbbef661b6106
MD5 bc10d0ed8972b07a9b144cb86b507638
SHA1 f9872cc32087637371a1dc2f10326a1ed4b5ab78
SHA512 02d1e9c54c2d5d29e9c2454ab5856241334d49025c713cc4535104db8342a204f0739bb2a9c9b5b49375ca8cbc69bc3cc41b4a077ac14bed755085e2f236d92d
SSDEEP 12288:nwji6+ZoE2oaXKOAilmVx+igEpONKiKjZTe57X:ciJTbaXlAUnKiKjJe57X
TLSH
T1D3949D01B6C0C0B2D1AD253124AAA3369A3E7D605735D7C3F79CFA7A5F311D1AA2934E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wow64.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
Size 252KB
SHA256 f52e5179501a6880380641387210c0a0d03518897084c00480381c9a0d402dce
MD5 1af30f96d59b1b0bc140c9b640579d7c
SHA1 3d94d487bc74f70b118c26946fb096fb0dc278e7
SHA512 f6ceff3bf829ace56c87c378dd665cf574939a493bda7f12cd56e39c15de6b3e2b09353bdc526eeac7faf27e7217d8b8f3142cf6e2b2b9a6d2e2e3658ca3f3d1
SSDEEP 3072:32E6GukcxWtnwkwNBp0AUTjQzKgvyVx9QlllMS25RxarDDk+wY:32EcxW2kwNBp5UTsKgaQllaErf
TLSH
T1F4444B0176C4C032D27B21354877D375AA7ABD618BB48287BBDCAA7B5F705C28A37316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.7MB
SHA256 a7ea4c6a058e8d81d51c1305dec4324e5c6fc757f84d11a2f2c78571d6c00393
MD5 7933d9eb87a1fe8d91026bd85a05cf13
SHA1 23bcbb715459099ed14b7c9e981aab041616c5c7
SHA512 fcfbd35157bb381d4216f3921ddbf8d9d881cac688c725306719f3a5a0ff96d934aa02eb45c531ea29ca2e4a22aec7de58427bfa47069718d620574cb41a3e15
SSDEEP 24576:Qgojt8rfJLbXIpyxOjNONgc2gI0pRR9djPOZYVFR9MRsixD6Oo1e4XHbtSwyv:5UqrdspyxXn5Iy9Rdb92s27OgZ
TLSH
T136853363E5304AFBD86C2E3250BD2482AD7EFCF2F3690C4296557B1311ABB805A9D375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 395KB
SHA256 0e43d22649d6b2ecbac9915dc6498fe1f41777dd33147d962b30dad0d5e76ab3
MD5 4eed99fd77f4ff9c252f56e153f9c9ab
SHA1 995cecfe73f719c5135461402fdfb17d79721831
SHA512 df0b514491e48e0f6103c61833f24fd0822a5b7fbaf1df9f48263bb83b1d5e5157307d0f6b7fdf3281e32886d3d8201b4a378239d2cbd31584a7c200c2b69e03
SSDEEP 12288:l3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pu76:MaLbwKLDTH5+6pu76
TLSH
T1F084BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4124-567-0x0000000000DF0000-0x00000000013E7000-memory.dmp

Download

memory/4124-12-0x0000000000DF0000-0x00000000013E7000-memory.dmp

Download

memory/4124-584-0x0000000000DF0000-0x00000000013E7000-memory.dmp

Download

memory/4124-605-0x0000000000DF0000-0x00000000013E7000-memory.dmp

Download

memory/4124-618-0x0000000000DF0000-0x00000000013E7000-memory.dmp

Download

memory/4124-620-0x0000000000DF0000-0x00000000013E7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads