Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 15:47
Behavioral task
behavioral1
Sample
Loader_Free.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader_Free.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Loader_Free.exe
- Size 524KB
- Sample260620-s8bj4sfx8k
- SHA256 336c67126f712612619bcb3bd567e1d79cd333dda874c332f2544a8f55feb4c8
- MD5 b13f31804675466f743fbfc48b3e10ef
- SHA1 4c2393104db3841afba9f8dcc724f4e43e478e1a
- SHA512 e0815812f1b39186196f9600408e7ff75bacd1112a87ddbe66ab440781f9694f025033d340c608227031f3350b98725e2a015e9586beacafb690ce1643cd3d92
- SSDEEP 12288:rtKDC9sJ4Svu6ncp8x1B4+N7eRW/dISTaRHrhOKdweTF:rtKu9svFW+oRusRHF3rF
- TLSH T14BB458818608FFABFD2477F11D12FB93211DA8BD7C77A24945A8E1086F67DF24C099A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5708-0-0x00007FF71BA80000-0x00007FF71BBBA000-memory.dmp upx behavioral2/memory/5708-1-0x00007FF71BA80000-0x00007FF71BBBA000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe 5708 Loader_Free.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5708 wrote to memory of 6192 5708 Loader_Free.exe 90 PID 6192 wrote to memory of 7116 6192 cmd.exe 91 PID 6192 wrote to memory of 5496 6192 cmd.exe 92 PID 6192 wrote to memory of 5352 6192 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader_Free.exe"C:\Users\Admin\AppData\Local\Temp\Loader_Free.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader_Free.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:6192 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader_Free.exe" MD53⤵PID:7116
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:5496
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:5352
-
-