Analysis
- user interaction
yes - max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 04:31
General
- Target Launcher.bat
- Size 26B
- Sample260620-e5ewgaet8t
- SHA256 e1e6e28bc665b242fd4b496caf2542042d5720e87ea74551735664c202c486c7
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\loader.exeloader.exe proto.txt2⤵
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\CheckpointPush.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
index.dat
CUSTOM.DIC
ExcludeDictionaryEN0409.lex
fb3b0dbfee58fac8.customDestinations-ms
memory/612-127-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-120-0x00007FFD70F1F000-0x00007FFD70F20000-memory.dmp
memory/612-160-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-125-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-124-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-123-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-129-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-133-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-132-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-130-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/612-128-0x00007FFD70DC0000-0x00007FFD71023000-memory.dmp
memory/6760-30-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-23-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-40-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-41-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-39-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-13-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-38-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-62-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-63-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-78-0x000001E737AD0000-0x000001E737AD1000-memory.dmp
memory/6760-77-0x000001E737AD0000-0x000001E737AD1000-memory.dmp
memory/6760-76-0x000001E7361F0000-0x000001E736222000-memory.dmp
memory/6760-73-0x000001E7361E0000-0x000001E7361E1000-memory.dmp
memory/6760-61-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-59-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-58-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-57-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-56-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-60-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-37-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-36-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-35-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-34-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-33-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-32-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-31-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-42-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-29-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-28-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-27-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-26-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-25-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-24-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-43-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-22-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-21-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-20-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-19-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-18-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-17-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-16-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-15-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-14-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-12-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-10-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-9-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-8-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-7-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-6-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-4-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-5-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-3-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-44-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-47-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-46-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-48-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-49-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-51-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-52-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-53-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-55-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-50-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-54-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-1-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-2-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-0-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-45-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp
memory/6760-11-0x00007FFD92E70000-0x00007FFD92E80000-memory.dmp