93508a1bcc25c5989758f511c685d521b0735d2729ac1830f193a2ce7614cf9c

Analysis

max time kernel
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 23.2MB
Sample260711-ypr1msct2t
SHA256 93508a1bcc25c5989758f511c685d521b0735d2729ac1830f193a2ce7614cf9c
MD5 b184beb59f9bcc57b8fe86b584f002b9
SHA1 c44637827618ced107cfe61a1758ae2b0f624f58
SHA512 4a1721a6392a87a6d2b1103c3c0e7b389caf72eb5c74df414a8c501968b3c11ca607d0052bdecc578bbd685f77b3d459f719c2c7f0ba15b98e88db6bc767c6fa
SSDEEP 393216:w6f/JyuKmylpwvj1MK0GNlj+k3ztjzinzf0v5BEINq+fGQi/:wi/sLmywvJ0Ujtj2nzf0hBEhwK
TLSH
T147372383B8D9A1D8D3D78F109183158E37B172BB8D9E591E26C85C021912FA78DCEE77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4680	Loader.exe
4680	Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4680	Loader.exe
4680	Loader.exe
4680	Loader.exe
4680	Loader.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5516	cmd.exe
4080	net.exe
1660	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	Loader.exe
4680	Loader.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 5516	4680	Loader.exe	87
PID 5516 wrote to memory of 4080	5516	cmd.exe	89
PID 4080 wrote to memory of 1660	4080	net.exe	90
PID 4680 wrote to memory of 3956	4680	Loader.exe	91
PID 3956 wrote to memory of 5152	3956	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net start w32time >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:1660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w32tm /resync /force >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:5152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w32tm /resync /nowait >nul 2>&1
  2⤵
  PID:2464
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /nowait
    3⤵
    PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4680-0-0x0000000140414000-0x00000001412A4000-memory.dmp

Download

memory/4680-1-0x00007FF957FF0000-0x00007FF957FF2000-memory.dmp

Download

memory/4680-2-0x0000000140000000-0x00000001429E5000-memory.dmp

Download

memory/4680-6-0x0000000140000000-0x00000001429E5000-memory.dmp

Download

memory/4680-7-0x0000000140000000-0x00000001429E5000-memory.dmp

Download

memory/4680-8-0x0000000140000000-0x00000001429E5000-memory.dmp

Download