Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 14:36
General
- Target Launch.cmd
- Size 21B
- Sample260622-ryznhsds2p
- SHA256 37f60b7923dae8ab38bb72ccfe94bf06c3266202d4881e9d2e0ac28abcd85b25
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launch.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gcc.exegcc.exe ptd.txt2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1392-6-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-16-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-5-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-37-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-47-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-55-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-70-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/1392-71-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/1392-63-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-62-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-61-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-60-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-59-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-58-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-57-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-56-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-54-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-53-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-52-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-51-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-50-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-49-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-48-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-46-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-45-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-44-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-43-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-42-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-41-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-40-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-39-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-38-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-36-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-35-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-34-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-33-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-32-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-31-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-28-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-27-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-24-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-23-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-22-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-21-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-20-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-19-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-18-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-17-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-30-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-29-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-26-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-25-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-15-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-14-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-13-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-12-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-11-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-10-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-9-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-8-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-7-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-4-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-2-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-1-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-0-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-3-0x000000007FB10000-0x000000007FB20000-memory.dmp
memory/1392-76-0x00000000031C0000-0x0000000003200000-memory.dmp
memory/1392-77-0x0000000003200000-0x0000000003201000-memory.dmp
memory/1392-81-0x00000000018D0000-0x00000000018D1000-memory.dmp
memory/1392-82-0x0000000001A10000-0x0000000001A11000-memory.dmp
memory/1392-83-0x0000000003200000-0x0000000003201000-memory.dmp