Analysis
- geolocation tags
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-de - resource tags
- submitted
30/09/2026, 16:04
General
- Target marlowwwclient-main/gradlew.bat
- Size 2KB
- Sample260930-thwm2aca93
- SHA256 9ca26d733ada3a45f27b2151288f54e75c9f95b287d1f82ef942ec5cc2d4f006
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\marlowwwclient-main\gradlew.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava.exe -version2⤵
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe"java.exe" "-Xmx64m" "-Xms64m" "-Dorg.gradle.appname=gradlew" -jar "C:\Users\Admin\AppData\Local\Temp\marlowwwclient-main\\gradle\wrapper\gradle-wrapper.jar"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
native-platform.dll
jansi.dll
gradle-base-services-9.2.1.jar
gradle-build-process-services-9.2.1.jar
gradle-classloaders-9.2.1.jar
gradle-concurrent-9.2.1.jar
gradle-gradle-cli-main-9.2.1.jar
gradle-launcher-9.2.1.jar
gradle-logging-9.2.1.jar
gradle-service-lookup-9.2.1.jar
gradle-stdlib-java-extensions-9.2.1.jar
memory/1652-13-0x0000018B24970000-0x0000018B24BE0000-memory.dmp
memory/1652-12-0x0000018B24950000-0x0000018B24951000-memory.dmp
memory/1652-2-0x0000018B24970000-0x0000018B24BE0000-memory.dmp
memory/1752-119-0x000002415D860000-0x000002415D870000-memory.dmp
memory/1752-128-0x000002415D800000-0x000002415D810000-memory.dmp
memory/1752-44-0x000002415D720000-0x000002415D730000-memory.dmp
memory/1752-47-0x000002415D730000-0x000002415D740000-memory.dmp
memory/1752-46-0x000002415D440000-0x000002415D6B0000-memory.dmp
memory/1752-53-0x000002415D6B0000-0x000002415D6C0000-memory.dmp
memory/1752-51-0x000002415D740000-0x000002415D750000-memory.dmp
memory/1752-52-0x000002415D750000-0x000002415D760000-memory.dmp
memory/1752-55-0x000002415D760000-0x000002415D770000-memory.dmp
memory/1752-54-0x000002415D6C0000-0x000002415D6D0000-memory.dmp
memory/1752-59-0x000002415D770000-0x000002415D780000-memory.dmp
memory/1752-58-0x000002415D6D0000-0x000002415D6E0000-memory.dmp
memory/1752-57-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-61-0x000002415D6E0000-0x000002415D6F0000-memory.dmp
memory/1752-62-0x000002415D780000-0x000002415D790000-memory.dmp
memory/1752-67-0x000002415D790000-0x000002415D7A0000-memory.dmp
memory/1752-66-0x000002415D6F0000-0x000002415D700000-memory.dmp
memory/1752-71-0x000002415D7A0000-0x000002415D7B0000-memory.dmp
memory/1752-70-0x000002415D700000-0x000002415D710000-memory.dmp
memory/1752-76-0x000002415D710000-0x000002415D720000-memory.dmp
memory/1752-77-0x000002415D7B0000-0x000002415D7C0000-memory.dmp
memory/1752-80-0x000002415D7C0000-0x000002415D7D0000-memory.dmp
memory/1752-79-0x000002415D720000-0x000002415D730000-memory.dmp
memory/1752-83-0x000002415D730000-0x000002415D740000-memory.dmp
memory/1752-84-0x000002415D7D0000-0x000002415D7E0000-memory.dmp
memory/1752-86-0x000002415D750000-0x000002415D760000-memory.dmp
memory/1752-87-0x000002415D7E0000-0x000002415D7F0000-memory.dmp
memory/1752-85-0x000002415D740000-0x000002415D750000-memory.dmp
memory/1752-89-0x000002415D7F0000-0x000002415D800000-memory.dmp
memory/1752-91-0x000002415D760000-0x000002415D770000-memory.dmp
memory/1752-92-0x000002415D800000-0x000002415D810000-memory.dmp
memory/1752-96-0x000002415D810000-0x000002415D820000-memory.dmp
memory/1752-95-0x000002415D770000-0x000002415D780000-memory.dmp
memory/1752-100-0x000002415D780000-0x000002415D790000-memory.dmp
memory/1752-101-0x000002415D820000-0x000002415D830000-memory.dmp
memory/1752-104-0x000002415D790000-0x000002415D7A0000-memory.dmp
memory/1752-105-0x000002415D830000-0x000002415D840000-memory.dmp
memory/1752-106-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-107-0x000002415D7A0000-0x000002415D7B0000-memory.dmp
memory/1752-108-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-111-0x000002415D840000-0x000002415D850000-memory.dmp
memory/1752-110-0x000002415D7B0000-0x000002415D7C0000-memory.dmp
memory/1752-116-0x000002415D850000-0x000002415D860000-memory.dmp
memory/1752-115-0x000002415D7C0000-0x000002415D7D0000-memory.dmp
memory/1752-118-0x000002415D7D0000-0x000002415D7E0000-memory.dmp
memory/1752-40-0x000002415D700000-0x000002415D710000-memory.dmp
memory/1752-122-0x000002415D870000-0x000002415D880000-memory.dmp
memory/1752-121-0x000002415D7E0000-0x000002415D7F0000-memory.dmp
memory/1752-124-0x000002415D7F0000-0x000002415D800000-memory.dmp
memory/1752-125-0x000002415D880000-0x000002415D890000-memory.dmp
memory/1752-131-0x000002415D810000-0x000002415D820000-memory.dmp
memory/1752-130-0x000002415D8A0000-0x000002415D8B0000-memory.dmp
memory/1752-129-0x000002415D890000-0x000002415D8A0000-memory.dmp
memory/1752-42-0x000002415D710000-0x000002415D720000-memory.dmp
memory/1752-134-0x000002415D820000-0x000002415D830000-memory.dmp
memory/1752-135-0x000002415D8B0000-0x000002415D8C0000-memory.dmp
memory/1752-138-0x000002415D8C0000-0x000002415D8D0000-memory.dmp
memory/1752-137-0x000002415D830000-0x000002415D840000-memory.dmp
memory/1752-142-0x000002415D8D0000-0x000002415D8E0000-memory.dmp
memory/1752-144-0x000002415D840000-0x000002415D850000-memory.dmp
memory/1752-146-0x000002415D850000-0x000002415D860000-memory.dmp
memory/1752-150-0x000002415D860000-0x000002415D870000-memory.dmp
memory/1752-153-0x000002415D870000-0x000002415D880000-memory.dmp
memory/1752-154-0x000002415D8E0000-0x000002415D8F0000-memory.dmp
memory/1752-156-0x000002415D880000-0x000002415D890000-memory.dmp
memory/1752-161-0x000002415D8A0000-0x000002415D8B0000-memory.dmp
memory/1752-160-0x000002415D890000-0x000002415D8A0000-memory.dmp
memory/1752-164-0x000002415D8B0000-0x000002415D8C0000-memory.dmp
memory/1752-166-0x000002415D8C0000-0x000002415D8D0000-memory.dmp
memory/1752-169-0x000002415D8D0000-0x000002415D8E0000-memory.dmp
memory/1752-174-0x000002415D900000-0x000002415D910000-memory.dmp
memory/1752-173-0x000002415D8F0000-0x000002415D900000-memory.dmp
memory/1752-177-0x000002415D8E0000-0x000002415D8F0000-memory.dmp
memory/1752-186-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-220-0x000002415D910000-0x000002415D920000-memory.dmp
memory/1752-322-0x000002415D900000-0x000002415D910000-memory.dmp
memory/1752-323-0x000002415D920000-0x000002415D930000-memory.dmp
memory/1752-321-0x000002415D8F0000-0x000002415D900000-memory.dmp
memory/1752-475-0x000002415D930000-0x000002415D940000-memory.dmp
memory/1752-517-0x000002415D940000-0x000002415D950000-memory.dmp
memory/1752-525-0x000002415D950000-0x000002415D960000-memory.dmp
memory/1752-527-0x000002415D960000-0x000002415D970000-memory.dmp
memory/1752-557-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-38-0x000002415D6F0000-0x000002415D700000-memory.dmp
memory/1752-36-0x000002415D6E0000-0x000002415D6F0000-memory.dmp
memory/1752-34-0x000002415D6D0000-0x000002415D6E0000-memory.dmp
memory/1752-633-0x000002415D970000-0x000002415D980000-memory.dmp
memory/1752-703-0x000002415D980000-0x000002415D990000-memory.dmp
memory/1752-788-0x000002415D990000-0x000002415D9A0000-memory.dmp
memory/1752-827-0x000002415D9A0000-0x000002415D9B0000-memory.dmp
memory/1752-980-0x000002415D9D0000-0x000002415D9E0000-memory.dmp
memory/1752-979-0x000002415D930000-0x000002415D940000-memory.dmp
memory/1752-32-0x000002415D6C0000-0x000002415D6D0000-memory.dmp
memory/1752-954-0x000002415D920000-0x000002415D930000-memory.dmp
memory/1752-953-0x000002415D9C0000-0x000002415D9D0000-memory.dmp
memory/1752-991-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-952-0x000002415D9B0000-0x000002415D9C0000-memory.dmp
memory/1752-951-0x000002415D910000-0x000002415D920000-memory.dmp
memory/1752-31-0x000002415D6B0000-0x000002415D6C0000-memory.dmp
memory/1752-26-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-16-0x000002415D440000-0x000002415D6B0000-memory.dmp
memory/1752-1046-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-1048-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-1049-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-1053-0x000002415B9E0000-0x000002415B9E1000-memory.dmp
memory/1752-1128-0x000002415B9E0000-0x000002415B9E1000-memory.dmp