Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/02/2026, 00:04
General
- Target Loader.exe
- Size 359KB
- Sample260211-acn68act4b
- SHA256 ec7c5533adfb5a919951a4973983064b2103918bcf9f93a8c351a152a1f63567
Malware Config
Signatures
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 29 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows SystemEnv Core" /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Loader.exeC:\Users\Admin\AppData\Local\Temp\Loader.exe1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Loader.exeC:\Users\Admin\AppData\Local\Temp\Loader.exe1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Loader.exeC:\Users\Admin\AppData\Local\Temp\Loader.exe1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Loader.exeC:\Users\Admin\AppData\Local\Temp\Loader.exe1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows SystemEnv Core"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/3260-0-0x00000000033A0000-0x00000000033E0000-memory.dmp
memory/3260-13-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-17-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-14-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-12-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-10-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-11-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-8-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-9-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-7-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-6-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-3-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-1-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-2-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-5-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-4-0x00000000049A0000-0x00000000049E5000-memory.dmp
memory/3260-18-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3260-33-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-29-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-32-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-31-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-30-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-28-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-27-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-26-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-24-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-23-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-22-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-36-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-25-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-21-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-39-0x00000000090F0000-0x0000000009135000-memory.dmp
memory/3260-50-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-54-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-53-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-52-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-51-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-49-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-48-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-47-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-46-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-45-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-44-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-43-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-41-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-42-0x00000000092C0000-0x0000000009305000-memory.dmp
memory/3260-58-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-71-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-70-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-69-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-68-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-67-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-66-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-65-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-62-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-63-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-61-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-59-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-64-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-60-0x0000000009310000-0x0000000009355000-memory.dmp
memory/3260-76-0x0000000009360000-0x00000000093A5000-memory.dmp
memory/3260-81-0x0000000009360000-0x00000000093A5000-memory.dmp
memory/3260-80-0x0000000009360000-0x00000000093A5000-memory.dmp
memory/3260-79-0x0000000009360000-0x00000000093A5000-memory.dmp
memory/3260-78-0x0000000009360000-0x00000000093A5000-memory.dmp
memory/3260-77-0x0000000009360000-0x00000000093A5000-memory.dmp
memory/3260-75-0x0000000009360000-0x00000000093A5000-memory.dmp