1c8161e1f2e2d00e71050b0f575e1afef48ec3034ecf53dbed8004df3d9b3630

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 1.7MB
Sample260706-wabc8sav4v
SHA256 1c8161e1f2e2d00e71050b0f575e1afef48ec3034ecf53dbed8004df3d9b3630
MD5 9155b482a42a6a441c03e89cf72a9743
SHA1 f544f85fef8fc237c805e004e30f9a5ec0197212
SHA512 a9ef12500ace0d7fc194af97d1cdcb2647b6173e90f2d7802c8fef733bc0c7582731b3ab052840cc6dbd46e9fae8c47fb64f31272c35d5cd48783b89260a55bc
SSDEEP 24576:qsi/mDEo7fzE7pcqpfkG4cy/VV4Rm+EfX+UbjeuR7YwL:BDV7fzapcqpfkGeV4RFOtHeuR7Y
TLSH
T13E85180EAAB682E5D0BAD07CC692A52BFC31345A83305BE356999F532F277E4D53D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

persistence

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x0004000000016b50-2.dat	disable_win_def

Executes dropped EXE 2 IoCs

pid	Process
3180	RuntimeBroker.exe
5588	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe"	Loader.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3464	Loader.exe
3464	Loader.exe
3180	RuntimeBroker.exe
3180	RuntimeBroker.exe
5588	RuntimeBroker.exe
5588	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 3180	3464	Loader.exe	86

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3180

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
Size 1.7MB
SHA256 1c8161e1f2e2d00e71050b0f575e1afef48ec3034ecf53dbed8004df3d9b3630
MD5 9155b482a42a6a441c03e89cf72a9743
SHA1 f544f85fef8fc237c805e004e30f9a5ec0197212
SHA512 a9ef12500ace0d7fc194af97d1cdcb2647b6173e90f2d7802c8fef733bc0c7582731b3ab052840cc6dbd46e9fae8c47fb64f31272c35d5cd48783b89260a55bc
SSDEEP 24576:qsi/mDEo7fzE7pcqpfkG4cy/VV4Rm+EfX+UbjeuR7YwL:BDV7fzapcqpfkGeV4RFOtHeuR7Y
TLSH
T13E85180EAAB682E5D0BAD07CC692A52BFC31345A83305BE356999F532F277E4D53D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.log

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\bot.log
Size 180B
SHA256 7a50cffe41afc180347ee71d236421df1c669b0f2115d17480f2b31f2102d0c3
MD5 1b074fffb76761d74efc63b7318365ed
SHA1 8f7f15b5670923241bfd4d0872718ca257fc3aa7
SHA512 2a6ce0dfafb6ac4bdc47f83eb520c69ee3577e678f39db1a65e4f5bd9363c3b08f04a91ee2f1ceff600e131c172f5ebe35f1645f6685d734520970930165d2d3
TLSH
T164C0120F0250162685C00200D28B5691E161F010F18FD81002D714DF5708CD34B9C833
MD5 SHA1 SHA512 TLSH

Submit Download