Analysis
- max time kernel
299s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 23:34
General
- Target RefreshTokenApp/RefreshTokenApp.bat
- Size 99B
- Sample260629-3kn6eahy5x
- SHA256 8a23f32587a4ee32add02eb48e98587fbdabd210db233845d2fc7def480b2224
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RefreshTokenApp\RefreshTokenApp.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RefreshTokenApp\runtime\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\RefreshTokenApp\runtime\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\RefreshTokenApp\app\refresh-token-authentication.jar"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5980-5-0x000001613CC50000-0x000001613CEC0000-memory.dmp
memory/5980-14-0x0000016135710000-0x0000016135980000-memory.dmp
memory/5980-15-0x000001613D1E0000-0x000001613D450000-memory.dmp
memory/5980-29-0x0000016135980000-0x0000016135990000-memory.dmp
memory/5980-33-0x00000161359A0000-0x00000161359B0000-memory.dmp
memory/5980-32-0x0000016135990000-0x00000161359A0000-memory.dmp
memory/5980-38-0x00000161359D0000-0x00000161359E0000-memory.dmp
memory/5980-37-0x00000161359C0000-0x00000161359D0000-memory.dmp
memory/5980-36-0x00000161359B0000-0x00000161359C0000-memory.dmp
memory/5980-44-0x0000016135710000-0x0000016135980000-memory.dmp
memory/5980-43-0x000001613CC50000-0x000001613CEC0000-memory.dmp
memory/5980-42-0x00000161359F0000-0x0000016135A00000-memory.dmp
memory/5980-41-0x00000161359E0000-0x00000161359F0000-memory.dmp
memory/5980-46-0x0000016135A00000-0x0000016135A10000-memory.dmp
memory/5980-48-0x000001613D1E0000-0x000001613D450000-memory.dmp
memory/5980-49-0x0000016135A10000-0x0000016135A20000-memory.dmp
memory/5980-52-0x0000016135A20000-0x0000016135A30000-memory.dmp
memory/5980-55-0x0000016135980000-0x0000016135990000-memory.dmp
memory/5980-56-0x0000016135A30000-0x0000016135A40000-memory.dmp
memory/5980-58-0x0000016135990000-0x00000161359A0000-memory.dmp
memory/5980-59-0x00000161359A0000-0x00000161359B0000-memory.dmp
memory/5980-60-0x0000016135A40000-0x0000016135A50000-memory.dmp
memory/5980-62-0x0000016135A50000-0x0000016135A60000-memory.dmp
memory/5980-64-0x00000161359B0000-0x00000161359C0000-memory.dmp
memory/5980-65-0x00000161359C0000-0x00000161359D0000-memory.dmp
memory/5980-66-0x00000161359D0000-0x00000161359E0000-memory.dmp
memory/5980-67-0x0000016135A60000-0x0000016135A70000-memory.dmp
memory/5980-69-0x0000016135A70000-0x0000016135A80000-memory.dmp
memory/5980-71-0x00000161359E0000-0x00000161359F0000-memory.dmp
memory/5980-72-0x00000161359F0000-0x0000016135A00000-memory.dmp
memory/5980-73-0x0000016135A80000-0x0000016135A90000-memory.dmp
memory/5980-75-0x0000016135A90000-0x0000016135AA0000-memory.dmp
memory/5980-77-0x0000016135A00000-0x0000016135A10000-memory.dmp
memory/5980-78-0x0000016135AA0000-0x0000016135AB0000-memory.dmp
memory/5980-80-0x0000016135A10000-0x0000016135A20000-memory.dmp
memory/5980-81-0x0000016135AB0000-0x0000016135AC0000-memory.dmp
memory/5980-83-0x0000016135A20000-0x0000016135A30000-memory.dmp
memory/5980-84-0x0000016135AC0000-0x0000016135AD0000-memory.dmp
memory/5980-86-0x0000016135A30000-0x0000016135A40000-memory.dmp
memory/5980-87-0x0000016135AD0000-0x0000016135AE0000-memory.dmp
memory/5980-89-0x0000016135A40000-0x0000016135A50000-memory.dmp
memory/5980-90-0x0000016135AE0000-0x0000016135AF0000-memory.dmp
memory/5980-92-0x0000016135A50000-0x0000016135A60000-memory.dmp
memory/5980-93-0x0000016135AF0000-0x0000016135B00000-memory.dmp
memory/5980-97-0x0000016135B00000-0x0000016135B10000-memory.dmp
memory/5980-96-0x0000016135A60000-0x0000016135A70000-memory.dmp
memory/5980-100-0x0000016135B10000-0x0000016135B20000-memory.dmp
memory/5980-99-0x0000016135A70000-0x0000016135A80000-memory.dmp
memory/5980-103-0x0000016135B20000-0x0000016135B30000-memory.dmp
memory/5980-102-0x0000016135A80000-0x0000016135A90000-memory.dmp
memory/5980-106-0x0000016135B30000-0x0000016135B40000-memory.dmp
memory/5980-105-0x0000016135A90000-0x0000016135AA0000-memory.dmp
memory/5980-109-0x0000016135B40000-0x0000016135B50000-memory.dmp
memory/5980-108-0x0000016135AA0000-0x0000016135AB0000-memory.dmp
memory/5980-112-0x0000016135B50000-0x0000016135B60000-memory.dmp
memory/5980-111-0x0000016135AB0000-0x0000016135AC0000-memory.dmp
memory/5980-115-0x0000016135B60000-0x0000016135B70000-memory.dmp
memory/5980-114-0x0000016135AC0000-0x0000016135AD0000-memory.dmp
memory/5980-118-0x0000016135B70000-0x0000016135B80000-memory.dmp
memory/5980-117-0x0000016135AD0000-0x0000016135AE0000-memory.dmp
memory/5980-121-0x0000016135AE0000-0x0000016135AF0000-memory.dmp
memory/5980-122-0x0000016135B80000-0x0000016135B90000-memory.dmp
memory/5980-123-0x0000016135B90000-0x0000016135BA0000-memory.dmp
memory/5980-124-0x0000016135AF0000-0x0000016135B00000-memory.dmp
memory/5980-126-0x0000016135B00000-0x0000016135B10000-memory.dmp
memory/5980-127-0x0000016135BA0000-0x0000016135BB0000-memory.dmp
memory/5980-129-0x0000016135B10000-0x0000016135B20000-memory.dmp
memory/5980-130-0x0000016135BB0000-0x0000016135BC0000-memory.dmp
memory/5980-133-0x0000016135B20000-0x0000016135B30000-memory.dmp
memory/5980-134-0x0000016135BC0000-0x0000016135BD0000-memory.dmp
memory/5980-136-0x0000016135B30000-0x0000016135B40000-memory.dmp
memory/5980-137-0x0000016135BD0000-0x0000016135BE0000-memory.dmp
memory/5980-139-0x0000016135B40000-0x0000016135B50000-memory.dmp
memory/5980-140-0x0000016135BE0000-0x0000016135BF0000-memory.dmp
memory/5980-142-0x0000016135B50000-0x0000016135B60000-memory.dmp
memory/5980-143-0x0000016135BF0000-0x0000016135C00000-memory.dmp
memory/5980-145-0x0000016135B60000-0x0000016135B70000-memory.dmp
memory/5980-146-0x0000016135C00000-0x0000016135C10000-memory.dmp
memory/5980-149-0x0000016135C10000-0x0000016135C20000-memory.dmp
memory/5980-148-0x0000016135B70000-0x0000016135B80000-memory.dmp
memory/5980-151-0x0000016135B90000-0x0000016135BA0000-memory.dmp
memory/5980-150-0x0000016135B80000-0x0000016135B90000-memory.dmp
memory/5980-153-0x0000016135C20000-0x0000016135C30000-memory.dmp
memory/5980-155-0x0000016135BA0000-0x0000016135BB0000-memory.dmp
memory/5980-156-0x0000016135C30000-0x0000016135C40000-memory.dmp
memory/5980-159-0x0000016135C40000-0x0000016135C50000-memory.dmp
memory/5980-158-0x0000016135BB0000-0x0000016135BC0000-memory.dmp
memory/5980-162-0x0000016135C50000-0x0000016135C60000-memory.dmp
memory/5980-161-0x0000016135BC0000-0x0000016135BD0000-memory.dmp
memory/5980-163-0x0000016135BD0000-0x0000016135BE0000-memory.dmp
memory/5980-164-0x0000016135BE0000-0x0000016135BF0000-memory.dmp
memory/5980-166-0x0000016135BF0000-0x0000016135C00000-memory.dmp
memory/5980-167-0x0000016135C60000-0x0000016135C70000-memory.dmp
memory/5980-169-0x0000016135C00000-0x0000016135C10000-memory.dmp
memory/5980-170-0x0000016135C70000-0x0000016135C80000-memory.dmp
memory/5980-171-0x0000016135C10000-0x0000016135C20000-memory.dmp