Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/05/2026, 01:57
General
- Target sub_b280e418cc13.exe
- Size 5.3MB
- Sample260524-cdh3psat4y
- SHA256 b280e418cc13c8f1efe66c8c5f4b83e0a544ddbb9d0c460e24d279b93a22c5b3
Malware Config
Extracted
-
aresloader
-
45.80.69.193
-
http://45.80.69.193/lomiboy/legit
-
http://45.80.69.193/lomiboy/payload
Signatures
- Family: AresLoader
AresLoader is a loader and downloader written in C++.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sub_b280e418cc13.exe"C:\Users\Admin\AppData\Local\Temp\sub_b280e418cc13.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tzutil /g2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tzutil.exetzutil /g3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MsMpEng.exe
memory/3196-0-0x00000000002A0000-0x0000000000924000-memory.dmp
memory/3196-1-0x00000000002A0000-0x0000000000924000-memory.dmp
memory/3196-2-0x0000000000447000-0x0000000000924000-memory.dmp
memory/3196-3-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-7-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-10-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-21-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-31-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-50-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-51-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-45-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-42-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-41-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-40-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-25-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-37-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-23-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-30-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-29-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-28-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-43-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-24-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-22-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-20-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-19-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-18-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-17-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-15-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-26-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-16-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-6-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-5-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-8-0x00000000002A0000-0x0000000000924000-memory.dmp
memory/3196-4-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-56-0x0000000000447000-0x0000000000924000-memory.dmp
memory/3196-69-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-67-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-70-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-64-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-63-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-78-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-82-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-86-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-80-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-62-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-68-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-72-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-77-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-81-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-83-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-113-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-112-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-111-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-79-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-93-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-104-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-76-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-74-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-71-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-66-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-91-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-65-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-88-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-60-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-75-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-73-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-61-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-59-0x00000000011C0000-0x0000000001685000-memory.dmp
memory/3196-428-0x00000000002A0000-0x0000000000924000-memory.dmp