Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FUDLoader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
FUDLoader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target FUDLoader.exe
- Size 17KB
- Sample260722-tp48raydpd
- SHA256 2a0ee7a60e6ed97004884fa911b657b7b5e59e7fc809795f006509eeebf883df
- MD5 0154e9523975abdaa00826a516fc1721
- SHA1 899dc49b13749e481a192b8a9e41a198ca41d943
- SHA512 dc4fb85e5e910eaac49797da1a18972abaa3cf8b29e6c9b2f282afdae8f63b76215f386c78c697494e4a6c3fb61d65194eca840ba7d276872bdefe73433f4181
- SSDEEP 384:ewYM/MZp0/w8sLUpGV2FYEkLe6HsBpXmWEvxW:qM/P48C9HWBg
- TLSH T17272292973E4973DDCF90BB998B2255946F0E7429C23EF1C2DC8A25E4E533C84652B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 9 4340 FUDLoader.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 8 raw.githubusercontent.com 9 raw.githubusercontent.com - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUDLoader.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4340 FUDLoader.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4344 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4340 FUDLoader.exe Token: SeDebugPrivilege 4340 FUDLoader.exe Token: SeDebugPrivilege 4344 taskmgr.exe Token: SeSystemProfilePrivilege 4344 taskmgr.exe Token: SeCreateGlobalPrivilege 4344 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe 4344 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUDLoader.exe"C:\Users\Admin\AppData\Local\Temp\FUDLoader.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4344