Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/07/2026, 13:17
General
- Target loader v1.3.exe
- Size 93.3MB
- Sample260702-qjdbase12x
- SHA256 e3ccf6bc99043a51a73d11bf660ef769e6f8010d9ebd88cd583f50c987bc0e0e
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader v1.3.exe"C:\Users\Admin\AppData\Local\Temp\loader v1.3.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\loader v1.3.exe"C:\Users\Admin\AppData\Local\Temp\loader v1.3.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4304-0-0x00000203F0942000-0x00000203F0943000-memory.dmp
memory/4304-1-0x00000203F0940000-0x00000203F0941000-memory.dmp
memory/4304-6-0x00000203F0946000-0x00000203F0947000-memory.dmp
memory/4304-5-0x00000203F0947000-0x00000203F0948000-memory.dmp
memory/4304-4-0x00000203F0945000-0x00000203F0946000-memory.dmp
memory/4304-2-0x00000203F0944000-0x00000203F0945000-memory.dmp
memory/4304-3-0x00000203F0943000-0x00000203F0944000-memory.dmp
memory/4304-12-0x00000203F0949000-0x00000203F094A000-memory.dmp
memory/4304-22-0x00000203F094A000-0x00000203F094B000-memory.dmp
memory/4304-24-0x00000203F0941000-0x00000203F0942000-memory.dmp
memory/4304-33-0x00000203F094E000-0x00000203F094F000-memory.dmp
memory/4304-32-0x00000203F094D000-0x00000203F094E000-memory.dmp
memory/4304-44-0x00000203F094F000-0x00000203F0950000-memory.dmp
memory/4304-45-0x00000203F0950000-0x00000203F0951000-memory.dmp
memory/4304-43-0x00000203F0945000-0x00000203F0946000-memory.dmp
memory/4304-31-0x00000203F094C000-0x00000203F094D000-memory.dmp
memory/4304-30-0x00000203F0942000-0x00000203F0943000-memory.dmp
memory/4304-23-0x00000203F094B000-0x00000203F094C000-memory.dmp
memory/4304-48-0x00000203F0953000-0x00000203F0954000-memory.dmp
memory/4304-46-0x00000203F0947000-0x00000203F0948000-memory.dmp
memory/4304-47-0x00000203F0946000-0x00000203F0947000-memory.dmp
memory/4304-49-0x00000203F0954000-0x00000203F0955000-memory.dmp
memory/4304-51-0x00000203E2C00000-0x00000203E2E00000-memory.dmp
memory/4304-50-0x00000203F0949000-0x00000203F094A000-memory.dmp
memory/4304-52-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-56-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-68-0x00000203F0963000-0x00000203F0964000-memory.dmp
memory/4304-70-0x00000203E2C00000-0x00000203E2E00000-memory.dmp
memory/4304-77-0x00000203F0964000-0x00000203F0966000-memory.dmp
memory/4304-76-0x00000203F095C000-0x00000203F095D000-memory.dmp
memory/4304-75-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-74-0x00000203E2C00000-0x00000203E2E00000-memory.dmp
memory/4304-73-0x00000203F0969000-0x00000203F096A000-memory.dmp
memory/4304-72-0x00000203F0968000-0x00000203F0969000-memory.dmp
memory/4304-71-0x00000203F0966000-0x00000203F0968000-memory.dmp
memory/4304-69-0x00000203E2C00000-0x00000203E2E00000-memory.dmp
memory/4304-67-0x00000203E2C00000-0x00000203E2E00000-memory.dmp
memory/4304-66-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-65-0x00000203F095E000-0x00000203F095F000-memory.dmp
memory/4304-64-0x00000203F095F000-0x00000203F0960000-memory.dmp
memory/4304-63-0x00000203F095D000-0x00000203F095E000-memory.dmp
memory/4304-62-0x00000203F095B000-0x00000203F095C000-memory.dmp
memory/4304-61-0x00000203F0959000-0x00000203F095B000-memory.dmp
memory/4304-60-0x00000203F0958000-0x00000203F0959000-memory.dmp
memory/4304-59-0x00000203F0957000-0x00000203F0958000-memory.dmp
memory/4304-58-0x00000203F0956000-0x00000203F0957000-memory.dmp
memory/4304-90-0x00000203F096A000-0x00000203F096C000-memory.dmp
memory/4304-92-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-96-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-93-0x0000020430A00000-0x0000020430C00000-memory.dmp
memory/4304-101-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-100-0x00000203F094D000-0x00000203F094E000-memory.dmp
memory/4304-99-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-98-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-97-0x0000020430A00000-0x0000020430C00000-memory.dmp
memory/4304-95-0x0000020430A00000-0x0000020430C00000-memory.dmp
memory/4304-94-0x0000020430A00000-0x0000020430C00000-memory.dmp
memory/4304-91-0x0000020430A00000-0x0000020430C00000-memory.dmp
memory/4304-89-0x00000203F094B000-0x00000203F094C000-memory.dmp
memory/4304-57-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-55-0x00000203F0955000-0x00000203F0956000-memory.dmp
memory/4304-54-0x0000020436000000-0x0000020436200000-memory.dmp
memory/4304-53-0x0000020436000000-0x0000020436200000-memory.dmp