Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/06/2026, 14:37
General
- Target launcher.cmd
- Size 27B
- Sample260622-ry5jrsds91
- SHA256 ccd107dc7de92cc112f656d433f95db249d6ab04a72622a4d4528863b56939d1
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\luajit.exeluajit.exe opcode.txt2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2508-25-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-24-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-64-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-121-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/2508-136-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/2508-135-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/2508-134-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/2508-120-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/2508-63-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-62-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-61-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-60-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-59-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-58-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-57-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-56-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-55-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-54-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-53-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-52-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-51-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-50-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-49-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-48-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-47-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-46-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-45-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-44-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-43-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-42-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-41-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-40-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-39-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-38-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-37-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-36-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-35-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-34-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-33-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-32-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-31-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-30-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-29-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-28-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-27-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-22-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-23-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-20-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-18-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-16-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-17-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-15-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-14-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-13-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-11-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-10-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-9-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-8-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-7-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-6-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-5-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-4-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-3-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-2-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-21-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-19-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-12-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-1-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-0-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2508-137-0x0000000000DE0000-0x0000000000DE1000-memory.dmp