Analysis
- user interaction
yes - max time kernel
50s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/07/2026, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loadеr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loadеr.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Loadеr.exe
- Size 10.0MB
- Sample260726-2mkekasdkh
- SHA256 113b5f3fa54560281bfc41043c2ba30f9d49e55cd611189a36d2def752812336
- MD5 c074f26f8b85810d581bf210de5bd5f0
- SHA1 ec31e044b78b9bc3d416e03c7d1b6b7b914e5a0c
- SHA512 0527fbb68c5118a3ab0185e9aaf08a57f1e3249705b75f135060dae005cc1d8e77d05d64e0c4b828c1e5fc01fc15e2c0fae7a75726693e755848805140fee350
- SSDEEP 49152:i/k2dUi1f8QUhehAsHszwCQ8ER0S7fHcgoeoaP/0/UK9UM6x6lEc/5/TfNGkLZJM:0s+gw7oeo3djbhLZzrkOG
- TLSH T182B6F66B2264816AC23D913BD0A3CB44ADF371B91F36C6E75E9053584A02FC37DBA635
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{B66E235B-DE94-4C3F-B205-ADD183273C6D} Loadеr.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 5388 Loadеr.exe 5388 Loadеr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4124 taskmgr.exe Token: SeSystemProfilePrivilege 4124 taskmgr.exe Token: SeCreateGlobalPrivilege 4124 taskmgr.exe Token: 33 4124 taskmgr.exe Token: SeIncBasePriorityPrivilege 4124 taskmgr.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe 4124 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4124 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loadеr.exe"C:\Users\Admin\AppData\Local\Temp\Loadеr.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5388
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1588