10539976590dfcaf4c39c75ece5aed9a9c1ef07a35d73079631b9a0fe54fb499

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 10.3MB
Sample260628-xsa1vsb16x
SHA256 10539976590dfcaf4c39c75ece5aed9a9c1ef07a35d73079631b9a0fe54fb499
MD5 3b1d87c1465036cd2d1832e04c310f11
SHA1 a6e48b18a5e6ebe1ed20923fdf8128b856610434
SHA512 8c65bd0d0adc242c53243960887fcaccfbcbe222c9084b205057d0d33e4ace96d84bca9709323cfb1a98eb2de32eba6135ab18e673101912ba85fd8879773baa
SSDEEP 196608:UgGoHp51GPt3vq1XyheOjpsndp5wEsQ7azC1GxjtkoqKMyOB3:UgLJux6Xy3adgVzMKn
TLSH
T191B622E71DFD8232E5875E79C64E2B9F13E0F012AE26640E37C518065E39BEB9846137
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 19 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4060	powershell.exe
3	3348	powershell.exe
4	2420	powershell.exe
5	5796	powershell.exe
6	3524	powershell.exe
7	3068	powershell.exe
9	5664	powershell.exe
10	5664	powershell.exe
11	5160	powershell.exe
12	5476	powershell.exe
13	5664	powershell.exe
20	5476	powershell.exe
21	5476	powershell.exe
22	5476	powershell.exe
23	4176	powershell.exe
24	2568	powershell.exe
25	2568	powershell.exe
32	2568	powershell.exe
33	6012	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5476	powershell.exe
4060	powershell.exe
2420	powershell.exe
5664	powershell.exe
4176	powershell.exe
2568	powershell.exe
6012	powershell.exe
3348	powershell.exe
5796	powershell.exe
3524	powershell.exe
3068	powershell.exe
5160	powershell.exe
1512	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
11	raw.githubusercontent.com
1	raw.githubusercontent.com
2	raw.githubusercontent.com
7	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
33	raw.githubusercontent.com
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6104	Loader.exe
6104	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4832	timeout.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
6104	Loader.exe
6104	Loader.exe
3348	powershell.exe
4060	powershell.exe
3348	powershell.exe
4060	powershell.exe
2420	powershell.exe
2420	powershell.exe
5796	powershell.exe
5796	powershell.exe
3524	powershell.exe
3524	powershell.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe
5664	powershell.exe
5664	powershell.exe
5664	powershell.exe
5160	powershell.exe
5160	powershell.exe
5160	powershell.exe
5476	powershell.exe
5476	powershell.exe
5476	powershell.exe
4176	powershell.exe
4176	powershell.exe
2568	powershell.exe
2568	powershell.exe
6012	powershell.exe
6012	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6104	Loader.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: 33	5388	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5388	AUDIODG.EXE
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	5796	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeIncreaseQuotaPrivilege	1512	powershell.exe
Token: SeSecurityPrivilege	1512	powershell.exe
Token: SeTakeOwnershipPrivilege	1512	powershell.exe
Token: SeLoadDriverPrivilege	1512	powershell.exe
Token: SeSystemProfilePrivilege	1512	powershell.exe
Token: SeSystemtimePrivilege	1512	powershell.exe
Token: SeProfSingleProcessPrivilege	1512	powershell.exe
Token: SeIncBasePriorityPrivilege	1512	powershell.exe
Token: SeCreatePagefilePrivilege	1512	powershell.exe
Token: SeBackupPrivilege	1512	powershell.exe
Token: SeRestorePrivilege	1512	powershell.exe
Token: SeShutdownPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeSystemEnvironmentPrivilege	1512	powershell.exe
Token: SeRemoteShutdownPrivilege	1512	powershell.exe
Token: SeUndockPrivilege	1512	powershell.exe
Token: SeManageVolumePrivilege	1512	powershell.exe
Token: 33	1512	powershell.exe
Token: 34	1512	powershell.exe
Token: 35	1512	powershell.exe
Token: 36	1512	powershell.exe
Token: SeDebugPrivilege	5664	powershell.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	5476	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	6012	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6104	Loader.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 6104 wrote to memory of 3348	6104	Loader.exe	89
PID 6104 wrote to memory of 4060	6104	Loader.exe	90
PID 6104 wrote to memory of 2420	6104	Loader.exe	94
PID 6104 wrote to memory of 5796	6104	Loader.exe	96
PID 6104 wrote to memory of 3524	6104	Loader.exe	98
PID 6104 wrote to memory of 3068	6104	Loader.exe	100
PID 6104 wrote to memory of 1972	6104	Loader.exe	102
PID 1972 wrote to memory of 1512	1972	cmd.exe	104
PID 1972 wrote to memory of 4832	1972	cmd.exe	107
PID 6104 wrote to memory of 5664	6104	Loader.exe	108
PID 6104 wrote to memory of 5160	6104	Loader.exe	110
PID 6104 wrote to memory of 5476	6104	Loader.exe	112
PID 6104 wrote to memory of 4176	6104	Loader.exe	114
PID 6104 wrote to memory of 2568	6104	Loader.exe	116
PID 6104 wrote to memory of 6012	6104	Loader.exe	118

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://github.com/projectsheldon/sheldon-binaries/releases/download/2.8.1/Sheldon.7z' -OutFile 'C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon\v2.8.1\sheldon_download.7z' -UseBasicParsing"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c title Adding Exclusion for Sheldon & echo. & echo === Sheldon Download Failure Recovery === & echo. & echo The downloaded executable was missing - likely removed by & echo Windows Defender or another antivirus. & echo. & echo Step 1/2: Adding exclusion path to Windows Defender... & echo Path: C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon & echo. & powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon'" && (echo [OK] Exclusion added successfully.) || (echo [FAILED] Could not add exclusion. Try adding it manually.) & echo. & echo Step 2/2: The loader will now retry the download. & echo If it succeeds, no further action is needed. & echo. & timeout /t 2 /nobreak > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://github.com/projectsheldon/sheldon-binaries/releases/download/2.8.1/Sheldon.7z' -OutFile 'C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon\v2.8.1\sheldon_download.7z' -UseBasicParsing"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://github.com/projectsheldon/sheldon-binaries/releases/download/2.4.2/Loader.7z' -OutFile 'C:\Users\Admin\AppData\Local\Temp\sheldon_download.7z' -UseBasicParsing"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/projectsheldon/sheldon-binaries/refs/heads/main/manifest.json' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x0000000000000500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...