Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 18:13
General
- Target 1Launcher.cmd
- Size 29B
- Sample261006-wtrvbsev6j
- SHA256 33a0f2ae33f8c9e8b9f2d32d72f81a135d12be54a81aee62e1a9ad8f6691cd4c
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1Launcher.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vendor.exevendor.exe protocol.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4976-48-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-46-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-63-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-62-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-76-0x0000021519F60000-0x0000021519F61000-memory.dmp
memory/4976-75-0x0000021519F60000-0x0000021519F61000-memory.dmp
memory/4976-74-0x0000021519F60000-0x0000021519F61000-memory.dmp
memory/4976-61-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-59-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-58-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-57-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-56-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-60-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-54-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-53-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-52-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-51-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-50-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-49-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-45-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-44-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-79-0x0000021519F70000-0x0000021519F71000-memory.dmp
memory/4976-43-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-84-0x0000021519F70000-0x0000021519F71000-memory.dmp
memory/4976-83-0x0000021519F70000-0x0000021519F71000-memory.dmp
memory/4976-42-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-41-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-40-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-39-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-38-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-37-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-36-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-35-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-34-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-31-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-30-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-29-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-27-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-26-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-25-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-24-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-23-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-22-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-9-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-20-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-19-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-18-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-17-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-16-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-15-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-14-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-13-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-12-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-11-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-10-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-8-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-6-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-4-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-5-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-3-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-2-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-0-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-55-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-47-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-33-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-32-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-28-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-21-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-7-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp
memory/4976-1-0x00007FF6D9F40000-0x00007FF6D9F50000-memory.dmp