d8809594785d9d33d0cb7399610f08dcc4bdfd379ad3a37991bc7f2c363fc4dc

Analysis

user interaction
yes
max time kernel
36s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 13.8MB
Sample260424-yllz8abs7r
SHA256 d8809594785d9d33d0cb7399610f08dcc4bdfd379ad3a37991bc7f2c363fc4dc
MD5 22bdfa48658b5839a920fa2c84cf64d6
SHA1 81236a576717922e7f8ded0b71607fa622953319
SHA512 6a55e90db9aa5c599430ded7e891e549b2f93f594f5a6c80b9fcf5ea1950be95222ea045e64d2cd542056d0325781af8786c44452a642736a5edeee6782b339c
SSDEEP 196608:KeZsAulLV3fphUiuLIIHiLTKmn4bhFn50leFu1TnmHwXUZbD+DDvbq2YQ8F2lDrN:ytxRhUtLgemi3HWkeEQgcGM
TLSH
T16AE623EA50D431D4C4D78B34639F57CE61F1F5668C60A62937CB2C03EE31EAB9249A63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3192	loader.exe
3192	loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3192	loader.exe
3192	loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 540	3192	loader.exe	85
PID 540 wrote to memory of 5480	540	cmd.exe	86
PID 540 wrote to memory of 5944	540	cmd.exe	87
PID 540 wrote to memory of 5628	540	cmd.exe	88
PID 3192 wrote to memory of 3144	3192	loader.exe	93

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\loader.exe" MD5
    3⤵
    PID:5480
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5944
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause >nul
  2⤵
  PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3192-0-0x000000014015E000-0x000000014096A000-memory.dmp

Download

memory/3192-1-0x00007FFF06570000-0x00007FFF06572000-memory.dmp

Download

memory/3192-2-0x00007FFF06580000-0x00007FFF06582000-memory.dmp

Download

memory/3192-4-0x0000000140000000-0x0000000141733000-memory.dmp

Download

memory/3192-7-0x0000000140000000-0x0000000141733000-memory.dmp

Download

memory/3192-8-0x0000000140000000-0x0000000141733000-memory.dmp

Download

memory/3192-17-0x0000000002190000-0x00000000024E5000-memory.dmp

Download

memory/3192-18-0x000000014015E000-0x000000014096A000-memory.dmp

Download

memory/3192-19-0x0000000140000000-0x0000000141733000-memory.dmp

Download

memory/5480-16-0x000002164A510000-0x000002164A865000-memory.dmp

Download