Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/08/2026, 06:14
General
- Target Launcher.cmd
- Size 43B
- Sample260823-gzmegahe28
- SHA256 964dfb63ff140149ed8b310dba63fd8d82a82dc9979348e93b3dd7206fd71d13
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\luajit.exeluajit.exe clib.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2596-49-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-36-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-24-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-16-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-3-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-63-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-5-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-62-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-127-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/2596-126-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/2596-125-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/2596-124-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/2596-61-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-60-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-59-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-58-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-57-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-56-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-55-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-53-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-54-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-52-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-46-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-51-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-50-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-48-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-47-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-44-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-45-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-41-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-43-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-42-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-40-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-39-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-38-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-37-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-35-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-34-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-33-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-32-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-31-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-30-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-29-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-28-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-27-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-26-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-25-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-23-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-22-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-21-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-20-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-17-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-19-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-18-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-15-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-14-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-13-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-12-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-11-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-10-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-9-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-8-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-7-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-6-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-4-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-2-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-1-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-0-0x0000000077110000-0x0000000077120000-memory.dmp
memory/2596-139-0x00000000024D0000-0x00000000024D1000-memory.dmp