Analysis
- geolocation tags
- user interaction
yes - max time kernel
204s - max time network
185s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 21:54
General
- Target Loader.exe
- Size 68.9MB
- Sample260420-1sn49set6n
- SHA256 c30b4dbd542bc3bdd68ef264f3c74f0ead7c12b5b4ec786a3aeef63db2a886a0
Malware Config
Extracted
-
ps1
-
exe.dropper
https://download.pytorch.org/libtorch/cpu/libtorch-win-shared-with-deps-2.1.0%2Bcpu.zip
Extracted
-
ps1
-
exe.dropper
https://download.pytorch.org/libtorch/cu118/libtorch-win-shared-with-deps-2.1.0%2Bcu118.zip
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue';$r=Invoke-WebRequest -UseBasicParsing -Method Head -Uri 'https://download.pytorch.org/libtorch/cpu/libtorch-win-shared-with-deps-2.1.0%2Bcpu.zip';$r.Headers['Content-Length']"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue';[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;(New-Object Net.WebClient).DownloadFile('https://download.pytorch.org/libtorch/cpu/libtorch-win-shared-with-deps-2.1.0%2Bcpu.zip','C:\Users\Admin\AppData\Local\RevoSDK\libtorch_cpu\libtorch.zip')"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue';Expand-Archive -Force -Path 'C:\Users\Admin\AppData\Local\RevoSDK\libtorch_cpu\libtorch.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\RevoSDK\libtorch_cpu'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue';$r=Invoke-WebRequest -UseBasicParsing -Method Head -Uri 'https://download.pytorch.org/libtorch/cu118/libtorch-win-shared-with-deps-2.1.0%2Bcu118.zip';$r.Headers['Content-Length']"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue';[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;(New-Object Net.WebClient).DownloadFile('https://download.pytorch.org/libtorch/cu118/libtorch-win-shared-with-deps-2.1.0%2Bcu118.zip','C:\Users\Admin\AppData\Local\RevoSDK\libtorch_cuda\libtorch.zip')"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ModuleAnalysisCache
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fsurx3wy.mug.ps1
memory/1880-19074-0x000002013E7A0000-0x000002013E7AC000-memory.dmp
memory/1880-19075-0x000002013EBA0000-0x000002013EBB2000-memory.dmp
memory/1880-19076-0x0000020156ED0000-0x0000020156F3F000-memory.dmp
memory/1880-19093-0x0000020156ED0000-0x0000020156F3F000-memory.dmp
memory/1880-19091-0x000002013E7A0000-0x000002013E7AC000-memory.dmp
memory/2052-19094-0x00000209C6400000-0x00000209C649E000-memory.dmp
memory/2196-28-0x000001E8FC040000-0x000001E8FC062000-memory.dmp
memory/2196-39-0x000001E8E3500000-0x000001E8E3512000-memory.dmp
memory/2196-38-0x000001E8E1B70000-0x000001E8E1B7C000-memory.dmp
memory/2196-37-0x000001E8E19B0000-0x000001E8E1A4E000-memory.dmp
memory/3264-65-0x00000254C51E0000-0x00000254C524F000-memory.dmp
memory/3264-50-0x00000254AB2A0000-0x00000254AB2AC000-memory.dmp
memory/3264-52-0x00000254C51E0000-0x00000254C524F000-memory.dmp
memory/3264-63-0x00000254AB2A0000-0x00000254AB2AC000-memory.dmp
memory/3264-51-0x00000254C5040000-0x00000254C5052000-memory.dmp
memory/4684-19050-0x000001ADB0470000-0x000001ADB047C000-memory.dmp
memory/4684-19052-0x000001ADC8AD0000-0x000001ADC8B3F000-memory.dmp
memory/4684-80-0x000001ADC8D00000-0x000001ADC8D1C000-memory.dmp
memory/4684-81-0x000001ADC8D20000-0x000001ADC8DD3000-memory.dmp
memory/4684-82-0x000001ADC8DE0000-0x000001ADC8DEA000-memory.dmp
memory/4684-83-0x000001ADC8DE0000-0x000001ADC8DF2000-memory.dmp
memory/4684-84-0x000001ADC8D00000-0x000001ADC8D0A000-memory.dmp
memory/4684-2739-0x000001ADB0610000-0x000001ADB0622000-memory.dmp
memory/4684-2736-0x000001ADB0470000-0x000001ADB047C000-memory.dmp
memory/4684-2740-0x000001ADC8AD0000-0x000001ADC8B3F000-memory.dmp
memory/4944-5-0x00007FFF5A870000-0x00007FFF5A872000-memory.dmp
memory/4944-4-0x00007FFF5A860000-0x00007FFF5A862000-memory.dmp
memory/4944-13-0x0000018246410000-0x000001824641C000-memory.dmp
memory/4944-8-0x00007FF6732D0000-0x00007FF6742D0000-memory.dmp
memory/4944-1-0x00007FFF5ADA0000-0x00007FFF5ADA2000-memory.dmp
memory/4944-7-0x00007FFF58A30000-0x00007FFF58A32000-memory.dmp
memory/4944-6-0x00007FFF58A20000-0x00007FFF58A22000-memory.dmp
memory/4944-2-0x00007FFF5ADB0000-0x00007FFF5ADB2000-memory.dmp
memory/4944-12-0x0000018246330000-0x00000182463CE000-memory.dmp
memory/4944-0-0x00007FFF5AD90000-0x00007FFF5AD92000-memory.dmp
memory/4944-3-0x00007FFF5ADC0000-0x00007FFF5ADC2000-memory.dmp
memory/5676-19064-0x000002487B5D0000-0x000002487B63F000-memory.dmp
memory/5676-19062-0x00000248796F0000-0x00000248796FC000-memory.dmp
memory/5676-19063-0x000002487B020000-0x000002487B032000-memory.dmp