Resubmissions
11/04/2026, 19:27
260411-x53xeaay7x1002/04/2026, 17:58
260402-wj6kqshv7r01/04/2026, 16:03
260401-thhq6sdz9q1023/12/2025, 14:42
251223-r3c1batjez10Analysis
- max time kernel
29s - max time network
40s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/04/2026, 19:27
General
- Target _3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71.exe
- Size 81.4MB
- Sample260411-x53xeaay7x
- SHA256 3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71
Malware Config
Signatures
- Detects RoningLoader loader 17 IoCs
- RoningLoader
RoningLoader is a multi-stage malware loader used by the Dragon Breath APT.
- Roningloader family
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Users\Admin\AppData\Local\Temp\_3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71.exe"C:\Users\Admin\AppData\Local\Temp\_3218d686f3a0ba0023a7fa4bbe6de07e2b1c470d16473c09b62429c748a15f71.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Snoiekshiezioty\BqnIv3NZ\0VSo3d\oP6MiopZ.exe"C:\Program Files\\Snoiekshiezioty\BqnIv3NZ\0VSo3d\oP6MiopZ"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
6bYuNe.xU
CalculatorApp.dll
oP6MiopZ.exe
System.dll
nsis_tauri_utils.dll
memory/796-51-0x000001AFAA4A0000-0x000001AFAA51C000-memory.dmp
memory/3476-34-0x0000024153F30000-0x0000024153F31000-memory.dmp
memory/3476-28-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-39-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-36-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-37-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-31-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-35-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-32-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-29-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-38-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-40-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-41-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-43-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-44-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-42-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-45-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-46-0x00000241556F0000-0x000002415579E000-memory.dmp
memory/3476-47-0x0000000140000000-0x00000001402BE000-memory.dmp
memory/3476-30-0x0000000140000000-0x00000001402BE000-memory.dmp