Analysis
- max time kernel
60s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 15:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
load.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral2
Sample
load.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
60 seconds
General
- Target load.exe
- Size 17.6MB
- Sample260802-shk1vsck2x
- SHA256 7a6a6cd1608a61054a86fb6492b394ba7de0712525b341186111cb9067dd5b36
- MD5 1c0c7820c2a3b055eb845bddc21a38b4
- SHA1 a7f9b6ece2735151a3b81f91200f2eb87c5df663
- SHA512 3d85b139b7c8cb7928b4e2de9338292788084a9e6e9ca597addd4d5e244d49938fb2a27e1e5358daaacfaf1afa021b2e84cbc193cbbe766e174268bda89813b4
- SSDEEP 393216:vkc5ztiWDJ5OeiQOARGvufw2POrUsVjHKIafiI14kQXfQnmxZ:vNtnN5ZOKGvufwMOxVjH3auvZ
- TLSH T1DA07334B9B0023D4DCBF573C23D53FC47D866DD4478A2B1B626C2B4808DE619BD78A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 6068 load.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe 6068 load.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3420 wrote to memory of 6068 3420 load.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\load.exe"C:\Users\Admin\AppData\Local\Temp\load.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\58770E7B\load.exe"C:\Users\Admin\AppData\Local\Temp\58770E7B\load.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6068
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\58770E7B\load.exe
- Size 18.4MB
- SHA256 d4f6bfde46ea2394570619fa89f8cdc8ac00b297179fe8831558530ec48492f1
- MD5 38019371c7cfc54d0c08629da0384a1f
- SHA1 87509b8aa5549f22b53362588c624b010cfa5b26
- SHA512 75f204fa1be253a68678ec7a6637a8db1b02346fb429365500427e493fd0c2b2d2b24a4ae30de3f777c239af507c141f979b6012c8b394f663d073f2850d682d
- SSDEEP 393216:3KRqNWNKROYkhkpXorNv+oXsDS3LNK3HOU6x0pW/lJktSrZPLAB:aANWKRrpYrNvou7NK3uU6E29dPL
- TLSH T1981733D267D04BD8C353C6BC9583419EF2E27D07D77B8F9B3AC79A020AA1948506BD39
- MD5 SHA1 SHA512 SSDEEP TLSH