Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 18:14
General
- Target Launcher.cmd
- Size 21B
- Sample261029-wvbvhass8j
- SHA256 0b2dd257c50ed37c239e248987132ebc75138d09d01b3be5d360953c190ee5d6
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lua.exelua.exe cli.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5836-8-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-7-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-6-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-35-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-36-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-63-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-62-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-82-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/5836-81-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/5836-80-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/5836-79-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/5836-61-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-60-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-59-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-57-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-56-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-53-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-52-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-51-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-50-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-49-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-48-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-47-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-46-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-45-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-44-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-43-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-41-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-40-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-39-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-38-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-37-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-34-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-33-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-32-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-31-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-30-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-29-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-28-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-27-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-26-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-25-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-24-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-23-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-21-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-20-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-19-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-17-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-16-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-15-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-13-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-12-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-11-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-9-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-58-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-55-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-54-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-42-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-22-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-18-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-14-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-10-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-5-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-4-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-3-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-2-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-1-0x0000000058810000-0x0000000058820000-memory.dmp
memory/5836-0-0x0000000058810000-0x0000000058820000-memory.dmp