Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 06:14
General
- Target LaunchApp.bat
- Size 23B
- Sample260824-gzedvstdmh
- SHA256 a3e6236fa517f863ea551e17fcedcfc22df23e044dcd4863e6ddf3ef00966596
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LaunchApp.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\init.exeinit.exe icon.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1940-31-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-37-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-54-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-63-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-71-0x0000020851350000-0x0000020851351000-memory.dmp
memory/1940-70-0x0000020851350000-0x0000020851351000-memory.dmp
memory/1940-62-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-61-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-60-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-74-0x0000020851360000-0x0000020851392000-memory.dmp
memory/1940-75-0x00000208513A0000-0x00000208513A1000-memory.dmp
memory/1940-59-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-58-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-57-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-56-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-55-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-53-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-52-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-51-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-50-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-49-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-48-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-47-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-45-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-44-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-43-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-42-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-41-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-40-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-39-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-38-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-36-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-35-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-34-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-33-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-32-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-29-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-28-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-27-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-26-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-25-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-23-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-22-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-21-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-20-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-19-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-18-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-17-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-16-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-15-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-14-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-13-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-12-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-10-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-8-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-7-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-6-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-5-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-4-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-3-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-1-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-46-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-30-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-24-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-11-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-9-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-2-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-0-0x00007FF70D550000-0x00007FF70D560000-memory.dmp
memory/1940-109-0x0000020851350000-0x0000020851351000-memory.dmp
memory/1940-124-0x0000020851360000-0x0000020851392000-memory.dmp
memory/1940-125-0x00000208513A0000-0x00000208513A1000-memory.dmp