Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 12:18
General
- Target Launcher.cmd
- Size 25B
- Sample260628-pgsgrshs7m
- SHA256 ef8728febd42479bc42b6977a98d5183752442d1130ce6e10507aa7190a75732
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\reinit.exereinit.exe icon.txt2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1256-47-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-44-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-32-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-52-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-60-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-63-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-74-0x0000000001350000-0x0000000001351000-memory.dmp
memory/1256-73-0x0000000001060000-0x00000000010A0000-memory.dmp
memory/1256-72-0x0000000001060000-0x00000000010A0000-memory.dmp
memory/1256-62-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-61-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-58-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-57-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-56-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-55-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-54-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-53-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-59-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-51-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-50-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-49-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-48-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-46-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-45-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-41-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-43-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-42-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-40-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-39-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-38-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-37-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-36-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-35-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-34-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-33-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-31-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-30-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-29-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-28-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-27-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-26-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-25-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-23-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-24-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-22-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-21-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-20-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-19-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-18-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-17-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-16-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-15-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-14-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-12-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-11-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-10-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-9-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-8-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-7-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-6-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-5-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-4-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-3-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-1-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-0-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-13-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-2-0x000000007F720000-0x000000007F730000-memory.dmp
memory/1256-77-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1256-84-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1256-83-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/1256-87-0x0000000001060000-0x00000000010A0000-memory.dmp
memory/1256-89-0x0000000001350000-0x0000000001351000-memory.dmp
memory/1256-88-0x0000000001060000-0x00000000010A0000-memory.dmp
memory/1256-90-0x0000000002B00000-0x0000000002B01000-memory.dmp