Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 00:15
General
- Target Application.bat
- Size 22B
- Sample260814-akac2aeb96
- SHA256 8e322af81744217427abef3cab949aee1de70f1506f40e4e2d672af9e1f6ef0b
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Application.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lua.exelua.exe base.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4636-62-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-63-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-61-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-60-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-148-0x00000176A8290000-0x00000176A8291000-memory.dmp
memory/4636-147-0x00000176A8290000-0x00000176A8291000-memory.dmp
memory/4636-143-0x00000176A8280000-0x00000176A8281000-memory.dmp
memory/4636-142-0x00000176A8280000-0x00000176A8281000-memory.dmp
memory/4636-141-0x00000176A8280000-0x00000176A8281000-memory.dmp
memory/4636-59-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-58-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-57-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-56-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-55-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-54-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-53-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-52-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-51-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-49-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-40-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-48-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-47-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-46-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-45-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-44-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-43-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-42-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-41-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-38-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-36-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-35-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-34-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-33-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-32-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-31-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-30-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-29-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-28-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-27-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-26-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-24-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-23-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-22-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-21-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-20-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-19-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-18-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-17-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-16-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-15-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-14-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-11-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-12-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-9-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-7-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-6-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-5-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-4-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-3-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-2-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-1-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-50-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-39-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-37-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-25-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-13-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-10-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-8-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-0-0x00007FF6E8B10000-0x00007FF6E8B20000-memory.dmp
memory/4636-156-0x00000176A8280000-0x00000176A8281000-memory.dmp
memory/4636-157-0x00000176A8290000-0x00000176A8291000-memory.dmp