Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
21/10/2026, 14:04
General
- Target Launcher.cmd
- Size 28B
- Sample261021-rdgbfafd62
- SHA256 ce1e33483d353200a266b3bc383ccf500e5a760c6dcd8218747260f5bbe39509
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\luajit.exeluajit.exe uix.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1196-21-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-32-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-69-0x000001BF4A440000-0x000001BF4A441000-memory.dmp
memory/1196-68-0x000001BF4A440000-0x000001BF4A441000-memory.dmp
memory/1196-63-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-62-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-61-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-60-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-59-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-58-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-57-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-56-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-55-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-52-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-51-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-50-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-49-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-48-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-47-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-46-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-45-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-44-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-43-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-42-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-41-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-40-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-39-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-38-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-37-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-36-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-35-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-34-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-33-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-30-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-29-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-28-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-27-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-26-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-25-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-24-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-80-0x000001BF4A490000-0x000001BF4A491000-memory.dmp
memory/1196-79-0x000001BF4A490000-0x000001BF4A491000-memory.dmp
memory/1196-78-0x000001BF4A490000-0x000001BF4A491000-memory.dmp
memory/1196-23-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-22-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-20-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-19-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-18-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-16-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-15-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-14-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-13-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-12-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-11-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-10-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-9-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-8-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-7-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-6-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-5-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-4-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-3-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-54-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-53-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-31-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-17-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-2-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-1-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-0-0x00007FF642280000-0x00007FF642290000-memory.dmp
memory/1196-107-0x000001BF4A440000-0x000001BF4A441000-memory.dmp
memory/1196-122-0x000001BF4A480000-0x000001BF4A481000-memory.dmp
memory/1196-123-0x000001BF4A490000-0x000001BF4A491000-memory.dmp