Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
06/10/2026, 08:46
General
- Target Starter.bat
- Size 20B
- Sample261006-kpgb9aeb92
- SHA256 489c7caa02f8a7d16d745f2b9f790873c608789edb1a60f72ee6ba7b3a64d5be
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Starter.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lua.exelua.exe vm.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2728-43-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-51-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-63-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-62-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-61-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-60-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-59-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-58-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-57-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-56-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-55-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-54-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-53-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-52-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-50-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-49-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-48-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-47-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-46-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-45-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-44-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-42-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-41-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-34-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-39-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-38-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-37-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-35-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-126-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2728-128-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2728-125-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2728-124-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2728-33-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-31-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-29-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-27-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-25-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-24-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-23-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-22-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-21-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-20-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-19-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-18-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-17-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-16-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-15-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-14-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-13-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-12-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-11-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-10-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-9-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-8-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-7-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-6-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-5-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-4-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-3-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-2-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-1-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-40-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-36-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-32-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-30-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-28-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-26-0x000000005CB90000-0x000000005CBA0000-memory.dmp
memory/2728-0-0x000000005CB90000-0x000000005CBA0000-memory.dmp