Analysis
- max time kernel
103s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
24/03/2025, 11:20
General
- Target Application.bat
- Size 2KB
- Sample250324-nfgs7sslw3
- SHA256 863259a571e3ddc1a74563165f91a1754cac19f6525ee04420deb97c025d6da6
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Application.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\luajit.exeluajit.exe config.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc daily /st 11:30 /f /tn WindowsDefenderScheduledScan_ODEw /tr ""C:\Users\Admin\AppData\Local\ODEw\ODEw.exe" "C:\Users\Admin\AppData\Local\ODEw\config.txt""3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc daily /st 11:30 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\luajit.exe"C:\Users\Admin\AppData\Local\Temp\luajit.exe" "C:\Users\Admin\AppData\Local\Temp\sizeof.lua"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
json[1].json
sizeof.lua
memory/1196-260-0x0000000003130000-0x0000000003131000-memory.dmp
memory/1196-259-0x0000000003130000-0x0000000003131000-memory.dmp
memory/1196-267-0x0000000003130000-0x0000000003131000-memory.dmp
memory/1196-271-0x0000000003130000-0x0000000003131000-memory.dmp
memory/5880-38-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-32-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-18-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-17-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-16-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-23-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-52-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-51-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-50-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-49-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-48-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-47-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-46-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-44-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-43-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-42-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-61-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-63-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-62-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-60-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-59-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-58-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-57-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-56-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-55-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-54-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-53-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-41-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-40-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-39-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-20-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-35-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-36-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-31-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-19-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-33-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-34-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-30-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-29-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-27-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-26-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-25-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-24-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-22-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-45-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-37-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-28-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-21-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-15-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-14-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-13-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-12-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-74-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/5880-75-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/5880-11-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-8-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-7-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-6-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-5-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-3-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-2-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-10-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-4-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-0-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-9-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-1-0x000000007F270000-0x000000007F280000-memory.dmp
memory/5880-78-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/5880-80-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/5880-117-0x00000000006E0000-0x00000000006E1000-memory.dmp