morpheus_loader | 6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64

Analysis

max time kernel
149s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/03/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64.exe
Size 6.0MB
Sample260305-dndfmsb17y
SHA256 6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64
MD5 b66218206005bb5282f3460ade7732d2
SHA1 119729d2220f585d26fdca795b59b1a139cee9c9
SHA512 bac2b1b2ca36417d950e0b10b3c11d7932696c3ca6294483c3b3eee2790918a6d17593919899b459be691ec0693ab9b318536dd4ce4c0abcb751dcc823db802a
SSDEEP 49152:PwxyPtZv8gjS/K0ZeKwVDngXHcgsQYZfLNku79EjBoDSl90s0jM8mnwKeK9KpeC6:PbrjVycZhkO9MOA+1E
TLSH
T1B7566B17EC9155E9C0EEE2308A629153BE717C486B3123D32B90F7386FB6BD06A78754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery morpheus_loader loader persistence

Malware Config

Extracted

Family

morpheus_loader

http://sophos-upd-srv.info:4443

Signatures

MorpheusLoader
MorpheusLoader is a loader written in Golang.
loader morpheus_loader
Morpheus_loader family
morpheus_loader

Executes dropped EXE 2 IoCs

pid	Process
1160	SysSvc64.exe
5112	SysSvc64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\DzxKz = "\"C:\\Users\\Admin\\AppData\\Roaming\\SysSvc64.exe\" -log=\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svc.log\""	SysSvc64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\DzxKz = "\"C:\\Users\\Admin\\AppData\\Roaming\\SysSvc64.exe\" -log=\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svc.log\""	SysSvc64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5112	SysSvc64.exe
5112	SysSvc64.exe
1160	SysSvc64.exe
1160	SysSvc64.exe
5112	SysSvc64.exe
5112	SysSvc64.exe
1160	SysSvc64.exe
1160	SysSvc64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1160	1784	6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64.exe	79

C:\Users\Admin\AppData\Local\Temp\6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64.exe
"C:\Users\Admin\AppData\Local\Temp\6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Roaming\SysSvc64.exe
  C:\Users\Admin\AppData\Roaming\SysSvc64.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1160

C:\Users\Admin\AppData\Roaming\SysSvc64.exe
"C:\Users\Admin\AppData\Roaming\SysSvc64.exe" -log="C:\Users\Admin\AppData\Local\Temp\svc.log"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SysSvc64.exe

Path C:\Users\Admin\AppData\Roaming\SysSvc64.exe
Size 6.0MB
SHA256 6e1b152e34c76fab5414c4210a28bb5ca47b2155e6205e58e7df78ee9de6cb64
MD5 b66218206005bb5282f3460ade7732d2
SHA1 119729d2220f585d26fdca795b59b1a139cee9c9
SHA512 bac2b1b2ca36417d950e0b10b3c11d7932696c3ca6294483c3b3eee2790918a6d17593919899b459be691ec0693ab9b318536dd4ce4c0abcb751dcc823db802a
SSDEEP 49152:PwxyPtZv8gjS/K0ZeKwVDngXHcgsQYZfLNku79EjBoDSl90s0jM8mnwKeK9KpeC6:PbrjVycZhkO9MOA+1E
TLSH
T1B7566B17EC9155E9C0EEE2308A629153BE717C486B3123D32B90F7386FB6BD06A78754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download