Overview

overview

8

Static

static

3

Loader.exe

windows10-2004-x64

7

Loader.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    300s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 10:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Loader.exe
  • Size 9.2MB
  • Sample260604-mclsbadv3m
  • SHA256 3cc6d4c96641f54d89fac8edcef804a75fa1c4a572f175492865e695b95639f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5792
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$current = 'C:\Users\Admin\AppData\Local\Temp\Loader.exe'; $new = 'C:\Users\Admin\AppData\Local\Temp\loader_new.exe'; $final = 'C:\Users\Admin\AppData\Local\Temp\Loader.exe'; Start-Sleep -Milliseconds 500; Remove-Item -Force $current; Rename-Item -Path $new -NewName $final; Start-Process $final;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Deletes itself
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1784
      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:5752
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        manifest.json
        • Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon\manifest.json
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512
        Submit Download

        manifest.json
        • Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon\manifest.json
        • Size 280B
        • SHA256 a9fe7f365b998b5df4ae74da5f9aec64d9f4fff5bb31e4f2be55855b7f48c88a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Sheldon.exe
        • Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon\v2.3.2\_tmp\Sheldon.exe
        • Size 10.6MB
        • SHA256 371634247ede353a2e3de4697eb8884994f4b938d52821b9ab84ae779d3c9fb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_lwj3irhg.fwh.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwj3irhg.fwh.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        loader_new.exe
        • Path C:\Users\Admin\AppData\Local\Temp\loader_new.exe
        • Size 9.2MB
        • SHA256 3cc6d4c96641f54d89fac8edcef804a75fa1c4a572f175492865e695b95639f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1784-47-0x000001E05C380000-0x000001E05C3A2000-memory.dmp
        Download

        memory/5752-52-0x00007FFD04130000-0x00007FFD04132000-memory.dmp
        Download

        memory/5752-54-0x00007FF789F00000-0x00007FF78B3E8000-memory.dmp
        Download

        memory/5792-0-0x00007FF6C8EBB000-0x00007FF6C9228000-memory.dmp
        Download

        memory/5792-1-0x00007FFD04130000-0x00007FFD04132000-memory.dmp
        Download

        memory/5792-2-0x00007FF6C8670000-0x00007FF6C9B58000-memory.dmp
        Download

        memory/5792-34-0x00007FF6C8EBB000-0x00007FF6C9228000-memory.dmp
        Download