Overview

overview

10

Static

static

3

tmpt7q9tx89.exe

windows10-ltsc_2021-x64

10

tmpt7q9tx89.exe

windows10-2004-x64

10

tmpt7q9tx89.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/06/2026, 06:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpt7q9tx89.exe
  • Size 213KB
  • Sample260609-gwp17aes2r
  • SHA256 f11a133498793549236370835dd628282fed30bcc123f2a4a48e6d0faeeeca1b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetr2r2discoveryzloadertrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • r2

Campaign

  • r2

C2

  • https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

  • https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

Attributes
  • build_id

    136

rc4.plain
rsa_pubkey.plain

Signatures

  • Family: Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmpt7q9tx89.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpt7q9tx89.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3252
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 276
      2⤵
      • Program crash
      PID:52604
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3252 -ip 3252
    1⤵
      PID:25772

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 6e65e6b9880289cef5bf60d5af8683de4c35b9bf7340aec268e9148786c5d713
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 c5d79cc65d8353de464772a977f3633b265c4d549f7bab86c7ec648ed1158f7d
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 1366b50c743ecd17020cfbab4b8b66d9ef1038ef928d81adf32d528efff0543d
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 1ebfb7b58821288182a60dd70e929838f8245a8060f9d84ce851d034a71b05e3
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 0ebeaeafa6e843ac1260da7516732eeec63f62a50ad78f959af360655c95abeb
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 24e372f2f473aa287b2283f0f9c22d7fd80fdd19b42f9bc0566978beee359d21
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 74efbc02656f1f331dd37e26417eac35efdaf8fcaf3557c6979c3a333b08e786
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 fbdbc86f23302e2b168bd869887c1bf7aab9724359d723116c773462a51af2ed
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 275cc3f563d33b714dd8cfc4769bf16e0d3fce6fbb9f0a31dab108b8f10098b1
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 d19de8b9a668b90b23b519f4459ff5b48ac6cd721bb0cc18bbfb7b4cc07ec1a7
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 8347e7b6a8c96913cd33e564270e6e6b1bf1f1b03c5db0e7b12103b3287403f3
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 0e11487b230147db82f1813a30577a0530f29f1fad5cc2eeb10e8323cda79cbb
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 9ad6eb872360165f8bbdb7202ee5726b6d98f0424da78c2fc9d7ba95210bdf2a
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 f47dd1d64b73a8dcc24701b136b21160414ccce7d0b41f21283b774620a0b8e5
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 0e829d5f1d9af0212dc80a3399fbce29a7f602c19f14261e87ad7503a8c6e264
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 d62a24d4f77fe0d1d49c64be7bdc4371dae8072824eca60e5e76d19be6f5a920
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 9f07a1d473ac7214c792fbad73557633daf7631c55752d48eaa4b62b2d5583b8
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 4da98d92ac492f4a4936d93edd7905395e69b1254ee842a1cea02d8a79cec024
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 397e8023d9b452fe38a40395ddd733c4c9ede196cf113e332d02c8c6b5792709
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 bd43f65fb7529d3583979c702f7308c3b36bc30fa7031280e74961d2b1d27213
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 4341bc0338dc0b4c76c4ece68f09e09093f319a3c3d7e3e65581e2906b1ada7a
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 d1583f9718958d7cd69b06cc42783ada280ed546730f55053780fd8af8014726
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 fb9d6d2155ee95fb8b58fa96bc2201d8085cd8b30793c4bf4196cb159051919a
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 d505aac27b7494aed3dfe7a9b0200710d1a6af97c0425f0e38b016f4e2406937
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 91a58c7834ba46bc02012e40ce00975887eef237f48213b13746f4a5e77228ba
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 b202c25d3eadd61c87a3a0cd25df5a2527731241a8307c86843670eb6ea8c8da
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 91eb93d1d22fcaa0f504a52c0cd8595e4430642d25d0a85405d9f98cc5bc26fa
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 6187314af3daf432a9920495ff4e807f1df647b081ce3fc0738b84cb19931a5e
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 f24f5efd3c8cb562ff9dac0440da1af7ae1a464d73766e9fd1117c493358bd83
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 8065dff9688dda367a3f2cfdc0b902bbab9dbb32edef54de4c040cef6227d34a
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 f3ff40770769fe57dec6341ac3cb3b88bc675c2bfb994d168300b2ca381f7cea
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 0888a2f2e40b188f0084a28bd4cb24e0229292013c407f851462e55ad71c3928
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 30589ff52ddc090fdee74ff86f601c8733543ccdcecd756e90be648b2dd5c186
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 34c945d340b8118fa322d6fba43a113b6eff567eb1710d1e04543d4d6644aef6
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 f6fa7ddcfdfa9caa0f0f452f2f985934e0827144d84b53efd1ce4817ee6aaa48
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 4ce47556d306f5ced510e0e79e2719feb8c9fcc86b61b2ea5785b06873ea69cc
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 472efcf71ff0ec62d177e6031cc0d48d72397338266792bcfbad6583503c1bab
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 00513885bb14427a36e9522d488a0d08e70a0e37c471705b1c47bd1127745f42
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 448721ee08138228d51fc58cf269969c235f95f8635af9b6f045693f0bc87569
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 e7d55635e4c3e3df03f8780b0f964afa410740b4d1b645d85038e4e99ca919b0
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 135c3144cf2b0597c13e62ae47cf29703187c9ac64dfa9108411b2d419e9e05e
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 b8cf8d39fff93dbc366f6c73d66adc3069947008d3cb11bcf56778f29460c4f6
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 d01d1e114358666ca7b04bbf02995f85c2b9e49c022ab7ccd04996ae23a40092
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 9360c6f806166cf1f8b0a0e946ed889600490511ea71730c420c543f85ee4d17
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 ef2945d9f41c9a691edcff56917f5f11187256925523a393068a792b7e512200
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 ca8252deb6a1601a27e56a3e033a51f8fbfff8b37f8df561a20d17879bce5c35
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 176d13a1b5a34d3dc65bdcccce6abc2812097750b30768fe60597ffbc5ca80ac
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 fe2888c9f78f082a53918fc52a33d4d522fdc616696eb813d79cf55685f65546
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 c3fc30edec3ee28fbf50499ff2be8c1e539443dccb9dedd63ec70fb4700175e3
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 b30aa58394978eac8c1062c6de848bc8ce47c4f438a5fc1879f1549c2d993e5f
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 497b270b70bd84da28189fcbe729bc6ee9f92f3b852a97571a2bb44a42fcbe5b
          • MD5 SHA1 SHA512
          Submit Download

          tmp.txt
          • Path C:\Users\Admin\AppData\Local\Temp\tmp.txt
          • Size 4B
          • SHA256 a55bba385b9f76790d17a6eaf6b83d5c466f4db110aafd2312e0024a7bd9b3c4
          • MD5 SHA1 SHA512
          Submit Download

          memory/3252-2-0x0000000003030000-0x0000000003052000-memory.dmp
          Download

          memory/3252-111085-0x0000000003030000-0x0000000003052000-memory.dmp
          Download

          memory/3252-111080-0x0000000000400000-0x0000000002FC0000-memory.dmp
          Download

          memory/3252-1-0x0000000003170000-0x0000000003270000-memory.dmp
          Download