Analysis
- user interaction
yes - max time kernel
119s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/09/2026, 23:52
General
- Target Application.bat
- Size 23B
- Sample260901-3w1ctafd39
- SHA256 f4b650190b3f58c234df08e505bd956565105f647101c3c7c84f80563840187b
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Application.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zen.exezen.exe key.txt2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1164-36-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-35-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-65-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-203-0x00000000013F0000-0x00000000013F1000-memory.dmp
memory/1164-202-0x00000000013F0000-0x00000000013F1000-memory.dmp
memory/1164-201-0x00000000013F0000-0x00000000013F1000-memory.dmp
memory/1164-200-0x00000000013F0000-0x00000000013F1000-memory.dmp
memory/1164-64-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-63-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-62-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-61-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-60-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-59-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-58-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-57-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-56-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-55-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-54-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-53-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-52-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-51-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-50-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-49-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-48-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-47-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-45-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-44-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-43-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-42-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-41-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-40-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-39-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-38-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-34-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-32-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-31-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-30-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-29-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-28-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-27-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-26-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-25-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-21-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-20-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-18-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-17-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-13-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-12-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-37-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-11-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-9-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-8-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-7-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-2-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-1-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-0-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-33-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-24-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-23-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-22-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-19-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-16-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-14-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-10-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-6-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-5-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-4-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/1164-3-0x000000007F0A0000-0x000000007F0B0000-memory.dmp