Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 04:40
General
- Target loader.exe
- Size 93.3MB
- Sample260701-fatltaev5m
- SHA256 931e47ab4a793fa346d14b7b599cf9ce49521d3351e80d2098773f7dfa9c1e04
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1020-1-0x00000223DCDE0000-0x00000223DCDE1000-memory.dmp
memory/1020-0-0x00000223DCDE2000-0x00000223DCDE3000-memory.dmp
memory/1020-4-0x00000223DCDE5000-0x00000223DCDE6000-memory.dmp
memory/1020-5-0x000002241CDDD000-0x000002241CDDE000-memory.dmp
memory/1020-3-0x00000223DCDE4000-0x00000223DCDE5000-memory.dmp
memory/1020-2-0x00000223DCDE3000-0x00000223DCDE4000-memory.dmp
memory/1020-7-0x000002241CDDE000-0x000002241CDDF000-memory.dmp
memory/1020-6-0x00000223DCDE6000-0x00000223DCDE7000-memory.dmp
memory/1020-18-0x00000223DCDE7000-0x00000223DCDE8000-memory.dmp
memory/1020-24-0x00000223DCDE9000-0x00000223DCDEB000-memory.dmp
memory/1020-23-0x00000223DCDE8000-0x00000223DCDE9000-memory.dmp
memory/1020-28-0x00000223DCDE2000-0x00000223DCDE3000-memory.dmp
memory/1020-27-0x00000223DCDEC000-0x00000223DCDED000-memory.dmp
memory/1020-26-0x00000223DCDE1000-0x00000223DCDE2000-memory.dmp
memory/1020-25-0x00000223DCDEB000-0x00000223DCDEC000-memory.dmp
memory/1020-29-0x00000223DCDED000-0x00000223DCDEE000-memory.dmp
memory/1020-45-0x00000223DCDEE000-0x00000223DCDEF000-memory.dmp
memory/1020-46-0x00000223DCDEF000-0x00000223DCDF1000-memory.dmp
memory/1020-48-0x00000223DCDE6000-0x00000223DCDE7000-memory.dmp
memory/1020-49-0x00000223DCDF1000-0x00000223DCDF2000-memory.dmp
memory/1020-47-0x000002241CDDD000-0x000002241CDDE000-memory.dmp
memory/1020-44-0x00000223DCDE5000-0x00000223DCDE6000-memory.dmp
memory/1020-50-0x00000223DCDF2000-0x00000223DCDF3000-memory.dmp
memory/1020-52-0x00000223CF200000-0x00000223CF400000-memory.dmp
memory/1020-55-0x00000223DCDF3000-0x00000223DCDF4000-memory.dmp
memory/1020-54-0x00000223DCDF5000-0x00000223DCDF6000-memory.dmp
memory/1020-53-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-51-0x00000223CF200000-0x00000223CF400000-memory.dmp
memory/1020-60-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-73-0x00000223CF200000-0x00000223CF400000-memory.dmp
memory/1020-77-0x00000223DCDF9000-0x00000223DCDFA000-memory.dmp
memory/1020-76-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-75-0x00000223DCDF4000-0x00000223DCDF5000-memory.dmp
memory/1020-74-0x00000223CF200000-0x00000223CF400000-memory.dmp
memory/1020-72-0x00000223CF200000-0x00000223CF400000-memory.dmp
memory/1020-71-0x00000223DCE03000-0x00000223DCE04000-memory.dmp
memory/1020-70-0x00000223DCE02000-0x00000223DCE03000-memory.dmp
memory/1020-69-0x00000223DCE01000-0x00000223DCE02000-memory.dmp
memory/1020-68-0x00000223DCE00000-0x00000223DCE01000-memory.dmp
memory/1020-67-0x00000223DCDFF000-0x00000223DCE00000-memory.dmp
memory/1020-66-0x00000223DCDFE000-0x00000223DCDFF000-memory.dmp
memory/1020-65-0x00000223DCDFD000-0x00000223DCDFE000-memory.dmp
memory/1020-64-0x00000223DCDF7000-0x00000223DCDF9000-memory.dmp
memory/1020-63-0x00000223DCDFC000-0x00000223DCDFD000-memory.dmp
memory/1020-62-0x00000223DCDFA000-0x00000223DCDFB000-memory.dmp
memory/1020-61-0x00000223DCDFB000-0x00000223DCDFC000-memory.dmp
memory/1020-59-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-58-0x00000223DCDF6000-0x00000223DCDF7000-memory.dmp
memory/1020-57-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-56-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-80-0x00000223DCE04000-0x00000223DCE06000-memory.dmp
memory/1020-79-0x00000223DCE06000-0x00000223DCE07000-memory.dmp
memory/1020-78-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-92-0x00000223DCDEC000-0x00000223DCDED000-memory.dmp
memory/1020-95-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-97-0x000002241CE00000-0x000002241D000000-memory.dmp
memory/1020-102-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-101-0x000002241CE00000-0x000002241D000000-memory.dmp
memory/1020-100-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-99-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-98-0x000002241CE00000-0x000002241D000000-memory.dmp
memory/1020-96-0x000002241CE00000-0x000002241D000000-memory.dmp
memory/1020-94-0x000002241CE00000-0x000002241D000000-memory.dmp
memory/1020-93-0x00000223DCE07000-0x00000223DCE09000-memory.dmp
memory/1020-103-0x0000022422400000-0x0000022422600000-memory.dmp
memory/1020-104-0x0000022422400000-0x0000022422600000-memory.dmp