Analysis
- max time kernel
150s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 07:34
General
- Target Loader.exe
- Size 8.0MB
- Sample260506-jecqmsgx6m
- SHA256 85f5ea3a80ff27bfe894a39810b5cfe4112577098d504c3b4c87b36a5ee5f6db
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\laddon.exe"C:\laddon.exe" 21802⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAAkAGMAcAB1ACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAgAC0ARQB4AHAAYQBuAGQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBwAHUAIAAtAGwAaQBrAGUAIAAnACoASQBuAHQAZQBsACoAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBJAG4AdABlAGwAIgAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATwB0AGgAZQByACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAA=3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chairfbi_addon_to_sdk
chairfbi_sdk_to_addon
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_wp13xnpy.tr1.ps1
363531303031303931305253434647.ini
chair_cache.json
chair_cache.json
chair_cache.json
laddon.exe
memory/412-193-0x0000024CC2FC0000-0x0000024CC2FD2000-memory.dmp
memory/412-192-0x0000024CDB1A0000-0x0000024CDB24F000-memory.dmp
memory/412-191-0x0000024CC13A0000-0x0000024CC13AC000-memory.dmp
memory/2064-3-0x0000018765500000-0x0000018765510000-memory.dmp
memory/2064-15-0x000001874B4C0000-0x000001874B4CC000-memory.dmp
memory/2064-14-0x000001874CCA0000-0x000001874CD4F000-memory.dmp
memory/2064-16-0x000001874CD50000-0x000001874CD62000-memory.dmp
memory/2064-11-0x0000018765500000-0x0000018765510000-memory.dmp
memory/2064-4-0x000001874D2D0000-0x000001874D2F2000-memory.dmp
memory/2064-2-0x0000018765500000-0x0000018765510000-memory.dmp
memory/2180-1321-0x0000023657230000-0x00000236575A8000-memory.dmp
memory/2180-387-0x0000023669D70000-0x0000023669D82000-memory.dmp
memory/2180-69-0x0000023657230000-0x00000236575A8000-memory.dmp
memory/2180-70-0x000002365C8B0000-0x000002365C8BC000-memory.dmp
memory/4500-176-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-35-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-99-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-114-0x000001F93DC60000-0x000001F93DC61000-memory.dmp
memory/4500-116-0x000001F93DC60000-0x000001F93DC61000-memory.dmp
memory/4500-82-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-120-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-44-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-134-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-135-0x000001F93E660000-0x000001F93E9D8000-memory.dmp
memory/4500-140-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-51-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-162-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-165-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-43-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-178-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-183-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-186-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-187-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-42-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-39-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-40-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-37-0x000001F93DB90000-0x000001F93DB91000-memory.dmp
memory/4500-245-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-246-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-248-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-38-0x000001F93DBE0000-0x000001F93DBE1000-memory.dmp
memory/4500-91-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-272-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-316-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-351-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-34-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-581-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-600-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-674-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-842-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-935-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-971-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1149-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1271-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-33-0x00007FF7F8820000-0x00007FF7F9369000-memory.dmp
memory/4500-1356-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1490-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1637-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1648-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1679-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1801-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1888-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1936-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-1948-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-2057-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-2086-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-2106-0x000001F93DB80000-0x000001F93DB81000-memory.dmp
memory/4500-2159-0x000001F93DB80000-0x000001F93DB81000-memory.dmp