Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/05/2026, 23:05
General
- Target shadow_loader.exe
- Size 3.1MB
- Sample260502-23b35agy21
- SHA256 77d3d352bc947245edc8380bb008423872eea37a81d84f182c7589d82a17e6ed
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\shadow_loader.exe"C:\Users\Admin\AppData\Local\Temp\shadow_loader.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\win_sys_update.exe"C:\Users\Admin\AppData\Local\Temp\win_sys_update.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /QUERY /TN "BLACK WOLF Cleaner"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
win_sys_update.exe
win_sys_update.exe.3.0.8.0.download
memory/4980-23-0x00007FF6FDB20000-0x00007FF6FDDF6000-memory.dmp
memory/5076-8-0x000000001BE40000-0x000000001BE50000-memory.dmp
memory/5076-20-0x000000001BE40000-0x000000001BE50000-memory.dmp
memory/5076-7-0x000000001BDF0000-0x000000001BE2C000-memory.dmp
memory/5076-5-0x000000001BE40000-0x000000001BE50000-memory.dmp
memory/5076-15-0x000000001BE40000-0x000000001BE50000-memory.dmp
memory/5076-16-0x0000000003310000-0x0000000003318000-memory.dmp
memory/5076-17-0x000000001F360000-0x000000001F398000-memory.dmp
memory/5076-18-0x000000001BE30000-0x000000001BE3E000-memory.dmp
memory/5076-19-0x000000001F330000-0x000000001F338000-memory.dmp
memory/5076-6-0x0000000003250000-0x0000000003262000-memory.dmp
memory/5076-21-0x000000001BE40000-0x000000001BE50000-memory.dmp
memory/5076-22-0x000000001BE40000-0x000000001BE50000-memory.dmp
memory/5076-4-0x0000000000EA0000-0x000000000108C000-memory.dmp
memory/5076-25-0x00000000032C0000-0x00000000032D2000-memory.dmp
memory/5076-26-0x000000001F3A0000-0x000000001F44F000-memory.dmp
memory/5076-24-0x0000000001890000-0x000000000189C000-memory.dmp
memory/5076-27-0x000000001BE40000-0x000000001BE50000-memory.dmp
memory/5076-28-0x000000001BE40000-0x000000001BE50000-memory.dmp