Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 13:21
General
- Target Loader.exe
- Size 36KB
- Sample260706-qlzbjsfx4t
- SHA256 d029797b4179de8ba30f1d5cb552cbbe8965a50b1e9a96eade82edc61079b356
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_15xeaxmk.1yj.ps1
memory/5824-1-0x00000000004F0000-0x0000000000500000-memory.dmp
memory/5824-0-0x00007FFDEC60F000-0x00007FFDEC610000-memory.dmp
memory/5824-7-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp
memory/5824-8-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp
memory/5824-10-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp
memory/5824-11-0x0000000002740000-0x0000000002762000-memory.dmp
memory/5824-12-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp
memory/5824-13-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp
memory/5824-14-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp
memory/5824-15-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp
memory/5824-16-0x00007FFDEC480000-0x00007FFDECE24000-memory.dmp