Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 14:37
General
- Target Application.bat
- Size 23B
- Sample260622-rzbcbadt91
- SHA256 a91b3308a7e9aa9fa660c72d27f226d8f50bfac2629f79a828fbecff323c0fe0
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Application.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\load.exeload.exe buff.log2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5672-20-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-24-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-22-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-58-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-63-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-62-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-81-0x000002CDFEA50000-0x000002CDFEA51000-memory.dmp
memory/5672-80-0x000002CDFEA50000-0x000002CDFEA51000-memory.dmp
memory/5672-79-0x000002CDFEA10000-0x000002CDFEA42000-memory.dmp
memory/5672-78-0x000002CDFCF30000-0x000002CDFCF31000-memory.dmp
memory/5672-61-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-60-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-59-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-57-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-55-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-56-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-54-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-52-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-53-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-51-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-50-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-49-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-48-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-47-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-46-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-45-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-44-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-43-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-42-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-41-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-40-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-39-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-37-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-36-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-35-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-34-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-33-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-32-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-31-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-30-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-29-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-28-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-27-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-26-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-25-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-21-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-19-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-18-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-17-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-16-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-15-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-14-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-11-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-12-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-10-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-8-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-7-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-6-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-5-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-4-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-3-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-38-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-23-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-13-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-9-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-2-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-1-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-0-0x00007FF6F7AA0000-0x00007FF6F7AB0000-memory.dmp
memory/5672-88-0x000002CDFEA10000-0x000002CDFEA42000-memory.dmp
memory/5672-89-0x000002CDFEA50000-0x000002CDFEA51000-memory.dmp