Analysis
- user interaction
yes - max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 17:06
General
- Target start.cmd
- Size 94B
- Sample260919-vmfcaatdqd
- SHA256 50fd8a0adaf81b8937ddd9cdbc19be86f636b8c10ff2e5bcc84b46faf91ef2c1
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exejavaw -cp "injector.jar;libs/*" tw.sartypants.vape.loader.ui.VapeLauncher2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
jna4826609592103832562.dll
memory/1144-48-0x000001CA218C0000-0x000001CA218D0000-memory.dmp
memory/1144-42-0x000001CA218A0000-0x000001CA218B0000-memory.dmp
memory/1144-22-0x000001CA21850000-0x000001CA21860000-memory.dmp
memory/1144-27-0x000001CA21860000-0x000001CA21870000-memory.dmp
memory/1144-28-0x000001CA1FB80000-0x000001CA1FB81000-memory.dmp
memory/1144-30-0x000001CA21870000-0x000001CA21880000-memory.dmp
memory/1144-35-0x000001CA21880000-0x000001CA21890000-memory.dmp
memory/1144-50-0x000001CA215E0000-0x000001CA21850000-memory.dmp
memory/1144-2-0x000001CA215E0000-0x000001CA21850000-memory.dmp
memory/1144-45-0x000001CA218B0000-0x000001CA218C0000-memory.dmp
memory/1144-11-0x000001CA1FB80000-0x000001CA1FB81000-memory.dmp
memory/1144-47-0x000001CA1FB80000-0x000001CA1FB81000-memory.dmp
memory/1144-40-0x000001CA21890000-0x000001CA218A0000-memory.dmp
memory/1144-53-0x000001CA21850000-0x000001CA21860000-memory.dmp
memory/1144-55-0x000001CA21860000-0x000001CA21870000-memory.dmp
memory/1144-56-0x000001CA218D0000-0x000001CA218E0000-memory.dmp
memory/1144-57-0x000001CA21870000-0x000001CA21880000-memory.dmp
memory/1144-58-0x000001CA21880000-0x000001CA21890000-memory.dmp
memory/1144-59-0x000001CA21890000-0x000001CA218A0000-memory.dmp
memory/1144-60-0x000001CA218A0000-0x000001CA218B0000-memory.dmp
memory/1144-61-0x000001CA218B0000-0x000001CA218C0000-memory.dmp
memory/1144-62-0x000001CA218C0000-0x000001CA218D0000-memory.dmp
memory/1144-63-0x000001CA218D0000-0x000001CA218E0000-memory.dmp