| File name: | TLauncher-MCL.exe |
| Full analysis: | https://app.any.run/tasks/2a218658-7ff6-4e0a-a4e4-8310cb254c17 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | June 03, 2024, 19:59:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows |
| MD5: | A8A3A5A77FA7A0FDA9D0E9833B812CB3 |
| SHA1: | 64C1D78C188DA796E5674A6073292D9156FB2BC5 |
| SHA256: | 796E104FC91175E0592C11B07098856E86CEAA5D33EFAB1BF46420B8B5047250 |
| SSDEEP: | 49152:kBdxBSeLBoBBsYBBlBBABsBeB5tB1CLz66QtNB7OBBeBBBBWBBqJBBBBQBBBBvWg:CANtjgG73z+kbvhPy3mp4DkXb |
MALICIOUS
Drops the executable file immediately after the start
- TLauncher-MCL.exe (PID: 3976)
SUSPICIOUS
Checks for Java to be installed
- TLauncher-MCL.exe (PID: 3976)
- TLauncher-MCL.exe (PID: 1580)
Process requests binary or script from the Internet
- java.exe (PID: 1200)
- java.exe (PID: 1840)
INFO
Checks supported languages
- TLauncher-MCL.exe (PID: 3976)
- javaw.exe (PID: 3992)
- java.exe (PID: 1200)
- wmpnscfg.exe (PID: 116)
- javaw.exe (PID: 552)
- java.exe (PID: 1840)
- TLauncher-MCL.exe (PID: 1580)
Create files in a temporary directory
- javaw.exe (PID: 3992)
- java.exe (PID: 1200)
- java.exe (PID: 1840)
- javaw.exe (PID: 552)
Creates files in the program directory
- javaw.exe (PID: 3992)
Reads the machine GUID from the registry
- java.exe (PID: 1200)
- java.exe (PID: 1840)
Reads the computer name
- java.exe (PID: 1200)
- wmpnscfg.exe (PID: 116)
- java.exe (PID: 1840)
Manual execution by a user
- wmpnscfg.exe (PID: 116)
- TLauncher-MCL.exe (PID: 1580)
Creates files or folders in the user directory
- java.exe (PID: 1840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (41) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (36.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.6) |
| .exe | | | Win32 Executable (generic) (5.9) |
| .exe | | | Win16/32 Executable Delphi generic (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2017:09:06 23:16:48+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 25088 |
| InitializedDataSize: | 377856 |
| UninitializedDataSize: | 36864 |
| EntryPoint: | 0x1290 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.5.13.0 |
| ProductVersionNumber: | 1.5.13.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Windows NT |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | - |
| FileDescription: | Free Minecraft launcher |
| FileVersion: | 1.5.13+master |
| InternalName: | tlauncher-mcl |
| LegalCopyright: | 2016 |
| LegalTrademarks: | - |
| OriginalFileName: | TLauncher-MCL.exe |
| ProductName: | TLauncher for MC-Launcher.com |
| ProductVersion: | 1.5.13+master |
Total processes
43
Monitored processes
8
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 552 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\Desktop\TLauncher-MCL.exe" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | — | TLauncher-MCL.exe | |||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 1200 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -Xmx128m -Dfile.encoding=UTF-8 -classpath C:\Users\admin\Desktop\TLauncher-MCL.exe ru.turikhay.tlauncher.bootstrap.Bootstrap | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | javaw.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Version: 8.0.2710.9 Modules
| |||||||||||||||
| 1580 | "C:\Users\admin\Desktop\TLauncher-MCL.exe" | C:\Users\admin\Desktop\TLauncher-MCL.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Free Minecraft launcher Exit code: 0 Version: 1.5.13+master Modules
| |||||||||||||||
| 1840 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -Xmx128m -Dfile.encoding=UTF-8 -classpath C:\Users\admin\Desktop\TLauncher-MCL.exe ru.turikhay.tlauncher.bootstrap.Bootstrap | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | javaw.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Version: 8.0.2710.9 Modules
| |||||||||||||||
| 3976 | "C:\Users\admin\Desktop\TLauncher-MCL.exe" | C:\Users\admin\Desktop\TLauncher-MCL.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Free Minecraft launcher Exit code: 0 Version: 1.5.13+master Modules
| |||||||||||||||
| 3992 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\Desktop\TLauncher-MCL.exe" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | — | TLauncher-MCL.exe | |||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 4068 | C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M | C:\Windows\System32\icacls.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 353
Read events
3 351
Write events
2
Delete events
0
Modification events
| (PID) Process: | (1200) java.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: java.exe | |||
| (PID) Process: | (1840) java.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: java.exe | |||
Executable files
0
Suspicious files
11
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1840 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\mcl.jar | compressed | |
MD5:F812F865D135D63000318B09943956DD | SHA256:61D722A822031A2BA72599C6B8B20FF9A0AB502BB043F0BA531FEE35839B0BFE | |||
| 1840 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\org\apache\httpcomponents\fluent-hc\4.5.13\fluent-hc-4.5.13.jar | compressed | |
MD5:8F7E4F1A95A870EBEE87DDACC425362C | SHA256:F883B6B027D5E05C53E48E4FE3548715C52DBD590FFA3F52D039574F1A4D0728 | |||
| 1840 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\org\apache\logging\log4j\log4j-core\2.19.0\log4j-core-2.19.0.jar | compressed | |
MD5:B7F521926226A16531F8E212B1DA1FFD | SHA256:B4A1796FAB7BFC36DF015C1B4052459147997E8D215A7199D71D05F9E747E4F4 | |||
| 1840 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher3802740486552819056.tmp | compressed | |
MD5:EFC895D2814188A4612E1AFA144BC1BF | SHA256:795F783DC6301D10E356D1F3DB9952D71692ED8004FFDD843F0049F813A0D1A5 | |||
| 1840 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher4687773079802409837.tmp | compressed | |
MD5:40D6B9075FBD28FA10292A45A0DB9457 | SHA256:6FE9026A566C6A5001608CF3FC32196641F6C1E5E1986D1037CCDBD5F31EF743 | |||
| 1840 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\org\apache\httpcomponents\httpclient\4.5.13\httpclient-4.5.13.jar | compressed | |
MD5:40D6B9075FBD28FA10292A45A0DB9457 | SHA256:6FE9026A566C6A5001608CF3FC32196641F6C1E5E1986D1037CCDBD5F31EF743 | |||
| 1840 | java.exe | C:\Users\admin\AppData\Roaming\.tlauncher\bin\lib\com\mojang\authlib\1.5.24\authlib-1.5.24.jar | compressed | |
MD5:EFC895D2814188A4612E1AFA144BC1BF | SHA256:795F783DC6301D10E356D1F3DB9952D71692ED8004FFDD843F0049F813A0D1A5 | |||
| 1200 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher405172850290783525.tmp | compressed | |
MD5:3868391DB33672F5FDC065D438358725 | SHA256:688BF85CEC5A7612BB6555EBA1EFD4DB0468521D6DDAFDC0D0B2228CF30A5121 | |||
| 1840 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher7517587691466016630.tmp | compressed | |
MD5:B7F521926226A16531F8E212B1DA1FFD | SHA256:B4A1796FAB7BFC36DF015C1B4052459147997E8D215A7199D71D05F9E747E4F4 | |||
| 1840 | java.exe | C:\Users\admin\AppData\Local\Temp\tlauncher6710378134011174609.tmp | compressed | |
MD5:8F7E4F1A95A870EBEE87DDACC425362C | SHA256:F883B6B027D5E05C53E48E4FE3548715C52DBD590FFA3F52D039574F1A4D0728 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
29
DNS requests
20
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1840 | java.exe | GET | 200 | 151.236.71.128:80 | http://cdn.turikhay.ru/tlauncher/mcl/bootstrap.json | unknown | — | — | unknown |
1200 | java.exe | GET | 200 | 151.236.71.128:80 | http://cdn.turikhay.ru/tlauncher/mcl/bootstrap.json | unknown | — | — | unknown |
1840 | java.exe | GET | 200 | 91.105.198.122:80 | http://turikhay.ru/tlauncher/repo/libraries/org/apache/httpcomponents/fluent-hc/4.5.13/fluent-hc-4.5.13.jar | unknown | — | — | unknown |
1840 | java.exe | GET | 200 | 91.105.198.122:80 | http://turikhay.ru/tlauncher/repo/libraries/com/mojang/authlib/1.5.24/authlib-1.5.24.jar | unknown | — | — | unknown |
1840 | java.exe | GET | 200 | 91.105.198.122:80 | http://turikhay.ru/tlauncher/repo/libraries/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar | unknown | — | — | unknown |
1840 | java.exe | GET | 200 | 91.105.198.122:80 | http://turikhay.ru/tlauncher/repo/libraries/org/apache/logging/log4j/log4j-core/2.19.0/log4j-core-2.19.0.jar | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1200 | java.exe | 151.236.71.128:80 | cdn.turikhay.ru | CDNetworks LLC | RU | unknown |
1200 | java.exe | 62.113.108.168:443 | ru2.lln4.ru | Beget LLC | RU | unknown |
1200 | java.exe | 51.38.188.198:443 | eu2.lln4.ru | OVH SAS | FR | unknown |
1840 | java.exe | 151.236.71.128:80 | cdn.turikhay.ru | CDNetworks LLC | RU | unknown |
1840 | java.exe | 62.113.108.168:443 | ru2.lln4.ru | Beget LLC | RU | unknown |
1840 | java.exe | 49.13.77.253:80 | eu3.lln4.ru | Hetzner Online GmbH | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
cdn.turikhay.ru |
| unknown |
ru2.lln4.ru |
| unknown |
eu2.lln4.ru |
| unknown |
eu1.llaun.ch |
| unknown |
ru1.lln4.ru |
| unknown |
eu2.llaun.ch |
| unknown |
ru3.llaun.ch |
| unknown |
eu3.llaun.ch |
| unknown |
eu3.lln4.ru |
| unknown |
ru1.llaun.ch |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1200 | java.exe | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |
1840 | java.exe | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |
— | — | Misc activity | ET INFO JAVA - Java Archive Download By Vulnerable Client |
— | — | Misc activity | ET INFO JAVA - Java Archive Download By Vulnerable Client |
— | — | A Network Trojan was detected | ET MALWARE Possible Metasploit Java Payload |
— | — | Misc activity | ET INFO JAVA - Java Archive Download By Vulnerable Client |
— | — | Misc activity | ET INFO JAVA - Java Archive Download By Vulnerable Client |