Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
01/10/2026, 18:06
General
- Target Adjust Binary/launch.bat
- Size 115B
- Sample261001-wpthcstfna
- SHA256 0953331a17b714fccb292ac20c402da61c7315a782506df19de0b4cacca85f22
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Adjust Binary\launch.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar Adjust.jar2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\.adjustclient\bin\Adjust.exeC:\Users\Admin\AppData\Roaming\.adjustclient\bin\Adjust.exe -Dnative.encoding=utf8 -Xmx4g -Xms4g -Xmn2g -XX:MaximumHeapSizePercent=50 -XX:MaximumYoungGenerationSizePercent=30 -XX:+CollectYoungGenerationSeparately -XX:MaxHeapFree=3072m -Djava.library.path=C:\Users\Admin\AppData\Roaming\.adjustclient\bin\natives -Dcerberus.port=245932566 -Dcerberus.secret=2456807423⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
jna15274944114223583981.dll
glfw.dll
lwjgl.dll
83aa4cc77f591dfc2374580bbd95f6ba_af1ca008-3e9a-4dd1-9ae2-69693d68292f
memory/2508-2-0x000002B447CB0000-0x000002B447F20000-memory.dmp
memory/2508-11-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-15-0x000002B447F20000-0x000002B447F30000-memory.dmp
memory/2508-16-0x000002B447F30000-0x000002B447F40000-memory.dmp
memory/2508-18-0x000002B447F40000-0x000002B447F50000-memory.dmp
memory/2508-20-0x000002B447F50000-0x000002B447F60000-memory.dmp
memory/2508-23-0x000002B447F60000-0x000002B447F70000-memory.dmp
memory/2508-24-0x000002B447F70000-0x000002B447F80000-memory.dmp
memory/2508-26-0x000002B447F80000-0x000002B447F90000-memory.dmp
memory/2508-29-0x000002B447F90000-0x000002B447FA0000-memory.dmp
memory/2508-30-0x000002B447CB0000-0x000002B447F20000-memory.dmp
memory/2508-31-0x000002B447FA0000-0x000002B447FB0000-memory.dmp
memory/2508-41-0x000002B447FE0000-0x000002B447FF0000-memory.dmp
memory/2508-40-0x000002B447FD0000-0x000002B447FE0000-memory.dmp
memory/2508-39-0x000002B447FC0000-0x000002B447FD0000-memory.dmp
memory/2508-38-0x000002B447F30000-0x000002B447F40000-memory.dmp
memory/2508-37-0x000002B447F20000-0x000002B447F30000-memory.dmp
memory/2508-33-0x000002B447FB0000-0x000002B447FC0000-memory.dmp
memory/2508-45-0x000002B447F40000-0x000002B447F50000-memory.dmp
memory/2508-46-0x000002B447FF0000-0x000002B448000000-memory.dmp
memory/2508-48-0x000002B447F50000-0x000002B447F60000-memory.dmp
memory/2508-49-0x000002B448000000-0x000002B448010000-memory.dmp
memory/2508-55-0x000002B448010000-0x000002B448020000-memory.dmp
memory/2508-54-0x000002B447F60000-0x000002B447F70000-memory.dmp
memory/2508-58-0x000002B448020000-0x000002B448030000-memory.dmp
memory/2508-57-0x000002B447F70000-0x000002B447F80000-memory.dmp
memory/2508-60-0x000002B447F80000-0x000002B447F90000-memory.dmp
memory/2508-61-0x000002B448030000-0x000002B448040000-memory.dmp
memory/2508-64-0x000002B448040000-0x000002B448050000-memory.dmp
memory/2508-63-0x000002B447F90000-0x000002B447FA0000-memory.dmp
memory/2508-66-0x000002B447FA0000-0x000002B447FB0000-memory.dmp
memory/2508-67-0x000002B448050000-0x000002B448060000-memory.dmp
memory/2508-70-0x000002B448060000-0x000002B448070000-memory.dmp
memory/2508-69-0x000002B447FB0000-0x000002B447FC0000-memory.dmp
memory/2508-72-0x000002B447FC0000-0x000002B447FD0000-memory.dmp
memory/2508-75-0x000002B448070000-0x000002B448080000-memory.dmp
memory/2508-74-0x000002B447FE0000-0x000002B447FF0000-memory.dmp
memory/2508-73-0x000002B447FD0000-0x000002B447FE0000-memory.dmp
memory/2508-79-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-81-0x000002B448080000-0x000002B448090000-memory.dmp
memory/2508-86-0x000002B448090000-0x000002B4480A0000-memory.dmp
memory/2508-85-0x000002B447FF0000-0x000002B448000000-memory.dmp
memory/2508-88-0x000002B448000000-0x000002B448010000-memory.dmp
memory/2508-89-0x000002B4480A0000-0x000002B4480B0000-memory.dmp
memory/2508-95-0x000002B448020000-0x000002B448030000-memory.dmp
memory/2508-94-0x000002B4480C0000-0x000002B4480D0000-memory.dmp
memory/2508-93-0x000002B4480B0000-0x000002B4480C0000-memory.dmp
memory/2508-92-0x000002B448010000-0x000002B448020000-memory.dmp
memory/2508-103-0x000002B4480E0000-0x000002B4480F0000-memory.dmp
memory/2508-102-0x000002B448040000-0x000002B448050000-memory.dmp
memory/2508-100-0x000002B4480D0000-0x000002B4480E0000-memory.dmp
memory/2508-99-0x000002B448030000-0x000002B448040000-memory.dmp
memory/2508-121-0x000002B4480F0000-0x000002B448100000-memory.dmp
memory/2508-120-0x000002B448050000-0x000002B448060000-memory.dmp
memory/2508-133-0x000002B448090000-0x000002B4480A0000-memory.dmp
memory/2508-132-0x000002B448130000-0x000002B448140000-memory.dmp
memory/2508-131-0x000002B448120000-0x000002B448130000-memory.dmp
memory/2508-130-0x000002B448080000-0x000002B448090000-memory.dmp
memory/2508-127-0x000002B448070000-0x000002B448080000-memory.dmp
memory/2508-126-0x000002B448110000-0x000002B448120000-memory.dmp
memory/2508-125-0x000002B448100000-0x000002B448110000-memory.dmp
memory/2508-124-0x000002B448060000-0x000002B448070000-memory.dmp
memory/2508-136-0x000002B448140000-0x000002B448150000-memory.dmp
memory/2508-135-0x000002B4480A0000-0x000002B4480B0000-memory.dmp
memory/2508-137-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-142-0x000002B448150000-0x000002B448160000-memory.dmp
memory/2508-141-0x000002B4480C0000-0x000002B4480D0000-memory.dmp
memory/2508-144-0x000002B448160000-0x000002B448170000-memory.dmp
memory/2508-140-0x000002B4480B0000-0x000002B4480C0000-memory.dmp
memory/2508-147-0x000002B4480D0000-0x000002B4480E0000-memory.dmp
memory/2508-152-0x000002B448170000-0x000002B448180000-memory.dmp
memory/2508-151-0x000002B4480E0000-0x000002B4480F0000-memory.dmp
memory/2508-156-0x000002B4480F0000-0x000002B448100000-memory.dmp
memory/2508-160-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-166-0x000002B448180000-0x000002B448190000-memory.dmp
memory/2508-165-0x000002B448190000-0x000002B4481A0000-memory.dmp
memory/2508-164-0x000002B448110000-0x000002B448120000-memory.dmp
memory/2508-163-0x000002B448100000-0x000002B448110000-memory.dmp
memory/2508-171-0x000002B4481A0000-0x000002B4481B0000-memory.dmp
memory/2508-170-0x000002B448130000-0x000002B448140000-memory.dmp
memory/2508-169-0x000002B448120000-0x000002B448130000-memory.dmp
memory/2508-173-0x000002B4481B0000-0x000002B4481C0000-memory.dmp
memory/2508-177-0x000002B4481C0000-0x000002B4481D0000-memory.dmp
memory/2508-176-0x000002B448140000-0x000002B448150000-memory.dmp
memory/2508-180-0x000002B4481D0000-0x000002B4481E0000-memory.dmp
memory/2508-179-0x000002B448150000-0x000002B448160000-memory.dmp
memory/2508-183-0x000002B4481E0000-0x000002B4481F0000-memory.dmp
memory/2508-182-0x000002B448160000-0x000002B448170000-memory.dmp
memory/2508-186-0x000002B4481F0000-0x000002B448200000-memory.dmp
memory/2508-187-0x000002B448200000-0x000002B448210000-memory.dmp
memory/2508-204-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-205-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-243-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-262-0x000002B448190000-0x000002B4481A0000-memory.dmp
memory/2508-263-0x000002B448180000-0x000002B448190000-memory.dmp
memory/2508-268-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-271-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-272-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-273-0x000002B4481A0000-0x000002B4481B0000-memory.dmp
memory/2508-279-0x000002B446420000-0x000002B446421000-memory.dmp
memory/2508-281-0x000002B447CB0000-0x000002B447F20000-memory.dmp
memory/2508-280-0x000002B4481B0000-0x000002B4481C0000-memory.dmp
memory/2508-283-0x000002B447F30000-0x000002B447F40000-memory.dmp
memory/2508-286-0x000002B447F60000-0x000002B447F70000-memory.dmp
memory/2508-285-0x000002B447F50000-0x000002B447F60000-memory.dmp
memory/2508-284-0x000002B447F40000-0x000002B447F50000-memory.dmp
memory/2508-282-0x000002B447F20000-0x000002B447F30000-memory.dmp