Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
23/10/2026, 12:13
General
- Target Installer.bat
- Size 27B
- Sample261023-pd6j8ast2n
- SHA256 60721f83efc4922d2a38b2b45628ba8b464d65b15bd44f4d0d319d81c0e73341
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Installer.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\luajit.exeluajit.exe module.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3524-19-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-51-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-63-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-62-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-93-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3524-92-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3524-91-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3524-90-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3524-89-0x0000000000740000-0x0000000000741000-memory.dmp
memory/3524-61-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-60-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-59-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-58-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-57-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-56-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-55-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-54-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-53-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-52-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-50-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-49-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-48-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-47-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-46-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-45-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-44-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-43-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-42-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-41-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-40-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-39-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-38-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-37-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-36-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-35-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-34-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-33-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-32-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-31-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-30-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-29-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-28-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-27-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-26-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-25-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-24-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-23-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-22-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-21-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-20-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-18-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-17-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-16-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-15-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-14-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-12-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-8-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-7-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-6-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-5-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-4-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-2-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-3-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-1-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-13-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-11-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-10-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-9-0x00000000677A0000-0x00000000677B0000-memory.dmp
memory/3524-0-0x00000000677A0000-0x00000000677B0000-memory.dmp