Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 04:37
General
- Target loader.exe
- Size 93.3MB
- Sample260701-e8wndsev2r
- SHA256 931e47ab4a793fa346d14b7b599cf9ce49521d3351e80d2098773f7dfa9c1e04
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1772-1-0x000002727F9E0000-0x000002727F9E1000-memory.dmp
memory/1772-0-0x000002727F9E2000-0x000002727F9E3000-memory.dmp
memory/1772-3-0x000002727F9E4000-0x000002727F9E5000-memory.dmp
memory/1772-7-0x000002727F9E7000-0x000002727F9E8000-memory.dmp
memory/1772-6-0x000002727F9E6000-0x000002727F9E7000-memory.dmp
memory/1772-5-0x00000272BF9DE000-0x00000272BF9DF000-memory.dmp
memory/1772-4-0x000002727F9E5000-0x000002727F9E6000-memory.dmp
memory/1772-2-0x000002727F9E3000-0x000002727F9E4000-memory.dmp
memory/1772-11-0x000002727F9E8000-0x000002727F9EA000-memory.dmp
memory/1772-37-0x000002727F9EC000-0x000002727F9ED000-memory.dmp
memory/1772-39-0x000002727F9ED000-0x000002727F9EF000-memory.dmp
memory/1772-38-0x000002727F9EF000-0x000002727F9F0000-memory.dmp
memory/1772-45-0x0000027239E00000-0x000002723A000000-memory.dmp
memory/1772-44-0x000002727F9E1000-0x000002727F9E2000-memory.dmp
memory/1772-43-0x000002727F9F1000-0x000002727F9F2000-memory.dmp
memory/1772-42-0x0000027239E00000-0x000002723A000000-memory.dmp
memory/1772-41-0x000002727F9F0000-0x000002727F9F1000-memory.dmp
memory/1772-40-0x000002727F9E2000-0x000002727F9E3000-memory.dmp
memory/1772-46-0x0000027239E00000-0x000002723A000000-memory.dmp
memory/1772-47-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-61-0x000002727F9F4000-0x000002727F9F5000-memory.dmp
memory/1772-73-0x000002727FA00000-0x000002727FA01000-memory.dmp
memory/1772-75-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-76-0x0000027239E00000-0x000002723A000000-memory.dmp
memory/1772-84-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-85-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-86-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-83-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-82-0x000002727FA05000-0x000002727FA06000-memory.dmp
memory/1772-81-0x000002727FA07000-0x000002727FA08000-memory.dmp
memory/1772-80-0x000002727FA06000-0x000002727FA07000-memory.dmp
memory/1772-79-0x000002727FA03000-0x000002727FA05000-memory.dmp
memory/1772-78-0x000002727FA02000-0x000002727FA03000-memory.dmp
memory/1772-77-0x0000027239E00000-0x000002723A000000-memory.dmp
memory/1772-74-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-72-0x000002727F9FF000-0x000002727FA00000-memory.dmp
memory/1772-71-0x000002727F9FE000-0x000002727F9FF000-memory.dmp
memory/1772-70-0x000002727F9FD000-0x000002727F9FE000-memory.dmp
memory/1772-69-0x000002727F9FC000-0x000002727F9FD000-memory.dmp
memory/1772-68-0x000002727F9FB000-0x000002727F9FC000-memory.dmp
memory/1772-67-0x000002727F9F9000-0x000002727F9FA000-memory.dmp
memory/1772-66-0x000002727F9F8000-0x000002727F9F9000-memory.dmp
memory/1772-65-0x000002727F9F7000-0x000002727F9F8000-memory.dmp
memory/1772-64-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-63-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-60-0x000002727F9F2000-0x000002727F9F4000-memory.dmp
memory/1772-59-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-62-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-87-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-88-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-89-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-95-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-94-0x000002727F9FA000-0x000002727F9FB000-memory.dmp
memory/1772-93-0x000002727F9F5000-0x000002727F9F7000-memory.dmp
memory/1772-92-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-91-0x00000272C5000000-0x00000272C5200000-memory.dmp
memory/1772-90-0x00000272C5000000-0x00000272C5200000-memory.dmp