Analysis
- user interaction
yes - max time kernel
19s - max time network
21s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
25/05/2026, 14:04
General
- Target Module Loader.rar
- Size 31KB
- Sample260525-rdjfssdw2t
- SHA256 52816ef4c1adbdcff534adfc5c152291a81e87dabb8af8211a073e8024ea6f49
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Module Loader.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Module Loader.exe"C:\Users\Admin\Desktop\Module Loader.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
JRPC.dll
Module Loader.exe
xdevkit.dll
memory/2416-10-0x00000000052B0000-0x0000000005342000-memory.dmp
memory/2416-11-0x0000000005470000-0x0000000005480000-memory.dmp
memory/2416-12-0x0000000005220000-0x000000000522A000-memory.dmp
memory/2416-13-0x0000000005470000-0x0000000005480000-memory.dmp
memory/2416-9-0x00000000057C0000-0x0000000005D66000-memory.dmp
memory/2416-17-0x00000000097A0000-0x00000000097AC000-memory.dmp
memory/2416-8-0x0000000000820000-0x000000000082E000-memory.dmp
memory/2416-21-0x0000000009BB0000-0x0000000009BC0000-memory.dmp
memory/2416-22-0x0000000005470000-0x0000000005480000-memory.dmp
memory/2416-23-0x0000000005470000-0x0000000005480000-memory.dmp