Analysis
- max time kernel
102s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 04:31
General
- Target Launcher.bat
- Size 26B
- Sample260620-e5ewgaet8t
- SHA256 e1e6e28bc665b242fd4b496caf2542042d5720e87ea74551735664c202c486c7
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exeloader.exe proto.txt2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc daily /st 10:30 /f /tn AudioManager_ODM5 /tr ""C:\Users\Admin\AppData\Local\ODM5\ODM5.exe" "C:\Users\Admin\AppData\Local\ODM5\proto.txt""3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc daily /st 10:30 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\ODM5\ODM5.exeC:\Users\Admin\AppData\Local\ODM5\ODM5.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\oobe\Setup.exeC:/Windows/System32/oobe/Setup.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\Setup\Scripts\ErrorHandler.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\ODM5\ODM5.exe" "C:\Users\Admin\AppData\Local\ODM5\proto.txt""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ODM5\ODM5.exe"C:\Users\Admin\AppData\Local\ODM5\ODM5.exe" "C:\Users\Admin\AppData\Local\ODM5\proto.txt"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
json[1].json
lua51.dll
proto.txt
0614BE286F9F4E409823D5629EC4CAF8.json
ErrorHandler.cmd
memory/2200-33-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-27-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-70-0x000001DCD5B80000-0x000001DCD5BB2000-memory.dmp
memory/2200-62-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-60-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-59-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-58-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-57-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-56-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-55-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-54-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-53-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-52-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-51-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-50-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-49-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-48-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-47-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-46-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-45-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-44-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-43-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-42-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-41-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-40-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-39-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-38-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-37-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-36-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-35-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-34-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-74-0x000001DCD5BD0000-0x000001DCD5BD1000-memory.dmp
memory/2200-32-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-31-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-30-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-29-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-28-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-71-0x000001DCD5B80000-0x000001DCD5BB2000-memory.dmp
memory/2200-26-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-25-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-24-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-23-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-22-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-21-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-20-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-19-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-18-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-17-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-16-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-15-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-14-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-13-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-12-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-11-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-10-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-9-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-8-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-7-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-6-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-5-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-4-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-3-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-72-0x000001DCD5BC0000-0x000001DCD5BC1000-memory.dmp
memory/2200-63-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-0-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-1-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-2-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-61-0x00007FFF905E0000-0x00007FFF905F0000-memory.dmp
memory/2200-77-0x000001DCD5BD0000-0x000001DCD5BD1000-memory.dmp
memory/2200-82-0x000001DCD5B80000-0x000001DCD5BB2000-memory.dmp
memory/2200-84-0x000001DCD5BC0000-0x000001DCD5BC1000-memory.dmp
memory/2200-83-0x000001DCD5B80000-0x000001DCD5BB2000-memory.dmp
memory/2200-85-0x000001DCD5BD0000-0x000001DCD5BD1000-memory.dmp