Analysis
- max time kernel
58s - max time network
23s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/06/2026, 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
60 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
60 seconds
General
- Target Loader.exe
- Size 4.4MB
- Sample260606-yn95tscv2n
- SHA256 dd1fdf8b1200b9bb54b94bbeb5d496eaa7d5b2a3f5bc9bfe57bf6bd875101b81
- MD5 9d26ad0b6083af6205d6dee861d8fc8c
- SHA1 d8c2fbe09500094fb8fb671d2dd3f417836d574d
- SHA512 dceb4d7c6c44bd7a00b58e1111210ebe0abc198afa2df692d9d1e2ac75083348877d6f05bb0aa3854e3e8ab2d7b5e5187021d5286fd90748082c8635d381b8c6
- SSDEEP 49152:wssfmK6qVfRn1sdrVJPjmEWDZ+JCJ8eBwykKZzZH8lUhaHXMFcaErNkrLkEr2LHy:8OHE93wykKZzZH8lUha3MFVL4LkpN
- TLSH T17026BF9273E94459DA23E13886465A0BE3717898032182F77FD549AD8F7B9E0CB3EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 5 discord.com - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 1 api.ipify.org - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe 3252 Loader.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3252 wrote to memory of 4792 3252 Loader.exe 81 PID 4792 wrote to memory of 3468 4792 cmd.exe 82 PID 4792 wrote to memory of 4868 4792 cmd.exe 83 PID 4792 wrote to memory of 4944 4792 cmd.exe 84 PID 3252 wrote to memory of 6000 3252 Loader.exe 85 PID 6000 wrote to memory of 3656 6000 cmd.exe 86 PID 6000 wrote to memory of 3312 6000 cmd.exe 87 PID 6000 wrote to memory of 4388 6000 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD53⤵PID:3468
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:4868
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Illusionary.lol\User\auth.json" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Illusionary.lol\User\auth.json" MD53⤵PID:3656
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:3312
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4388
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Illusionary.lol\User\auth.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512