Resubmissions
04/08/2026, 12:07
260804-pamb6saf89505/07/2026, 19:42
260705-yepsjaa13n505/07/2026, 18:50
260705-xgyyjse16z505/07/2026, 16:47
260705-vavansd14v5Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 16:47
General
- Target Loader.exe
- Size 12.6MB
- Sample260705-vavansd14v
- SHA256 c73c7140884570c40444f6a87967fa0c29124a985d96fd1f2ce6f2c398a28070
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4440-0-0x00007FF7F1A17000-0x00007FF7F1F26000-memory.dmp
memory/4440-2-0x00007FFA7C320000-0x00007FFA7C322000-memory.dmp
memory/4440-1-0x00007FFA7C310000-0x00007FFA7C312000-memory.dmp
memory/4440-3-0x00007FF7F0CC0000-0x00007FF7F2BC5000-memory.dmp
memory/4440-7-0x00007FF7F0CC0000-0x00007FF7F2BC5000-memory.dmp
memory/4440-8-0x00007FF7F0CC0000-0x00007FF7F2BC5000-memory.dmp
memory/4440-9-0x00007FF7F1A17000-0x00007FF7F1F26000-memory.dmp
memory/4440-10-0x00007FF7F0CC0000-0x00007FF7F2BC5000-memory.dmp