Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 12:13
General
- Target Installer.bat
- Size 27B
- Sample261023-pd6j8ast2n
- SHA256 60721f83efc4922d2a38b2b45628ba8b464d65b15bd44f4d0d319d81c0e73341
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Installer.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\luajit.exeluajit.exe module.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3940-26-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-23-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-39-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-62-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-61-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-97-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/3940-96-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/3940-95-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/3940-94-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/3940-60-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-59-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-58-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-57-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-56-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-54-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-53-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-52-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-51-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-50-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-49-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-48-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-47-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-46-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-45-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-44-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-43-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-42-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-41-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-38-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-37-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-36-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-35-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-34-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-33-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-32-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-31-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-30-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-29-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-28-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-27-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-25-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-24-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-21-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-22-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-20-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-18-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-17-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-16-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-15-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-14-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-13-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-12-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-11-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-10-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-9-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-8-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-7-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-6-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-5-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-4-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-1-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-0-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-63-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-55-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-40-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-19-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-3-0x0000000036DF0000-0x0000000036E00000-memory.dmp
memory/3940-2-0x0000000036DF0000-0x0000000036E00000-memory.dmp