Overview

overview

7

Static

static

3

ExLoader_I...er.exe

windows10-2004-x64

7

ExLoader_I...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 22:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ExLoader_Installer.exe
  • Size 22.2MB
  • Sample260706-2l4rtacz7x
  • SHA256 59d78963e8f56b25b95c18d5c672789ddb62ee0e186eda49250cef99edad78b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5148
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2720
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3612

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ExLoader_Installer.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
          • Size 160KB
          • SHA256 bec2ae84b937f42e78e99f5ac5834dacdec818cd843d34eb603749f8ac48b62b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP140.dll
          • Size 559KB
          • SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          audioplayers_windows_plugin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\audioplayers_windows_plugin.dll
          • Size 199KB
          • SHA256 132c0a4ab39e030baa937e20f170c6b0d446e3b1ce07e99375023c1773d60c15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.so
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so
          • Size 19.1MB
          • SHA256 ca4ef02c6f55922b4ca575406816a3e10876ce40e431be2e652dc25d17140404
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AssetManifest.bin
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin
          • Size 9KB
          • SHA256 c8b72a7552f25f2b9d28ca794fc8a5a62715414ee2d151a85441482dd944c4b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FontManifest.json
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json
          • Size 332B
          • SHA256 9e0903a9ceb64e32f7a139a143324252aae77dc58dbefb1f211fe03aa33460db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          NativeAssetsManifest.json
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\NativeAssetsManifest.json
          • Size 45B
          • SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
          • MD5 SHA1 SHA512
          Submit Download

          Warcraft.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\backgrounds\Warcraft.jpg
          • Size 98KB
          • SHA256 f88b682b452ad60cf3803cefe5c5c992db9688d47e550d757fa9c2d2114e72ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Bold.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Bold.otf
          • Size 46KB
          • SHA256 b012d85155925bbe2106b20234b96522dec7914f03b09bc6e2fff71554f31bf6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Light.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Light.otf
          • Size 45KB
          • SHA256 3c9ef459625f995c62b993b64da299204b741e153ba8e6d988463aaa86b1aa44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Medium.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Medium.otf
          • Size 46KB
          • SHA256 a728e91375dcadbdf6ef6d7e3cd0bbf5c56fb992d5b1be6640b83214c9d015ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-Regular.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Regular.otf
          • Size 45KB
          • SHA256 c7fc6d9f2ff611073fa09a6c61a8c086da0ebe8da841a9f4ec4087a3e9b52152
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NoirPro-SemiBold.otf
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-SemiBold.otf
          • Size 46KB
          • SHA256 50000ce2f0f8bf3018f1d04aa5c6716583b808ca05c802c46a9de4f084a91f7d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          grain.png
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\images\grain.png
          • Size 79KB
          • SHA256 cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          background_image.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\background_image.frag
          • Size 13KB
          • SHA256 9986d66db87b6ab3ee7182a688736c411459c0ac4f583e966fe529d685c15a80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modification_card_image.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\modification_card_image.frag
          • Size 30KB
          • SHA256 880e1a838aa9b41af69fdfaf54a2a5f2ab0d60cf75d0df91acc3e8dd101c16cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          raindrops.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\raindrops.frag
          • Size 51KB
          • SHA256 e139581178d563fc75aca12781a47e75c9020e13de3581273f901715afb691bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shimmer_effect.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\shimmer_effect.frag
          • Size 7KB
          • SHA256 fb4e69dedfd10f3690e863547a9a50567a1e2ab6c35ee7e56a3fa3dee7263de1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          winter.frag
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\winter.frag
          • Size 70KB
          • SHA256 43373bf6ccc11cf8a96ce00bc33bd0f20ff116b057a587557b4279a2b23edd54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat
          • Size 760KB
          • SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
          • Size 18.2MB
          • SHA256 f305282174da15723cee0913d805db06accb0b0de513fbd313affc9b173353ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          permission_handler_windows_plugin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\permission_handler_windows_plugin.dll
          • Size 115KB
          • SHA256 67465687870f83f264c090105385217c2addbf01781b56a239b79956ffe2a49b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          url_launcher_windows_plugin.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\url_launcher_windows_plugin.dll
          • Size 96KB
          • SHA256 9ff8c50b5dd18205126d7ead03ae7d7332e3b85cd450aa2656a04321ff888d32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll
          • Size 48KB
          • SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shared_preferences.json
          • Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
          • Size 144B
          • SHA256 652c038111abb742a37386528cc6c1841e130f712bddfbbc9c6ed7e29fef7e5c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2720-448-0x000002D1CC7E0000-0x000002D1CDAFD000-memory.dmp
          Download

          memory/2720-447-0x000002D1CC7E0000-0x000002D1CDAFD000-memory.dmp
          Download

          memory/2720-446-0x000002D1CC7E0000-0x000002D1CDAFD000-memory.dmp
          Download

          memory/2720-449-0x000002D1C9BD0000-0x000002D1C9BD1000-memory.dmp
          Download

          memory/2720-445-0x000002D1C9BC0000-0x000002D1C9BC1000-memory.dmp
          Download