Overview

overview

7

Static

static

3

RipehookLoader.exe

windows10-2004-x64

7

RipehookLoader.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    302s
  • max time network
    306s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 00:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RipehookLoader.exe
  • Size 154.6MB
  • Sample260803-anaszahn7v
  • SHA256 cbd7716b00337354a22e000e070c622ccd37b6b144088349e452a1ccd24492c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RipehookLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\RipehookLoader.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:3784
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3384

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          D3DCompiler_47_cor3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\D3DCompiler_47_cor3.dll
          • Size 4.5MB
          • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DirectWriteForwarder.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\DirectWriteForwarder.dll
          • Size 505KB
          • SHA256 2f430cf6c5692a957c77aad64ec1980ddb4fc4d8a47fa103081de5b8d5d91350
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Win32.Registry.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\Microsoft.Win32.Registry.dll
          • Size 117KB
          • SHA256 0c6fb02fe3e2fdc9b9e4737586caea80331424cd2806459ea49dd78848647e95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PresentationCore.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\PresentationCore.dll
          • Size 8.2MB
          • SHA256 1dcfc06376e5c1e464935fb1ae4a27ffc173784ff9f0172cf25807e7a0f35798
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PresentationFramework-SystemXml.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\PresentationFramework-SystemXml.dll
          • Size 33KB
          • SHA256 2ef7237f624ab7e1bb60cf4399aa194e8c81a1d23394c9ee4540e933fbe5e522
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PresentationFramework.Aero2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\PresentationFramework.Aero2.dll
          • Size 437KB
          • SHA256 9dbbf1d6488d15e7d197c624baf55a90eceb0fd86000408ddfa081cdb3093c7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PresentationFramework.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\PresentationFramework.dll
          • Size 15.4MB
          • SHA256 6249f64ba1f8c69964818340c2f032be8368769064f20e23ee34790a17ae64d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PresentationNative_cor3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\PresentationNative_cor3.dll
          • Size 1.2MB
          • SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RipehookLoader.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\RipehookLoader.dll
          • Size 176KB
          • SHA256 11cecb410c918a2ceb3538907ec4cd6b07d8399ba21052d2c8af6f7f4b942d63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Concurrent.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Collections.Concurrent.dll
          • Size 269KB
          • SHA256 e7118198a3a8b22ca39685a273d05db7b4f6c73e35d8d4ce462f66173e61fa53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.NonGeneric.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Collections.NonGeneric.dll
          • Size 101KB
          • SHA256 9d9f9e4fd5ff8f56a86d867a54927705fa77d6c3e0ed94c2a52112f3ec4193bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Specialized.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Collections.Specialized.dll
          • Size 101KB
          • SHA256 31e89caf6d21a20acc8ebbd390dd74d6c1340fae3a4abcf24bbf5dfef714a67d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Collections.dll
          • Size 253KB
          • SHA256 0937f7983c191dbb768c51bb9ae90621575c0a2cc3b185d85e31ac2f87001af2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.ComponentModel.Primitives.dll
          • Size 77KB
          • SHA256 7ace9d079c895f11c8afe54e420c8ca3a361e7fd7429b333a629094b08f73432
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.TypeConverter.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.ComponentModel.TypeConverter.dll
          • Size 729KB
          • SHA256 6ffa8c5934389ad34c0b840b87fefd44fc7605b5215b3188010f2cbc71969f60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.ComponentModel.dll
          • Size 29KB
          • SHA256 d0d5df86a307db3f7d0d59a39664c04f4fbb581103b6a89aa21395cd3f707af8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Configuration.ConfigurationManager.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Configuration.ConfigurationManager.dll
          • Size 1.0MB
          • SHA256 a4d9749822977375fda1c372b2c1748535a2ee20e65b7bb575686953f8738c6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.Process.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Diagnostics.Process.dll
          • Size 329KB
          • SHA256 5e7871e795a2c833fce3b0d02373f672ecdafdaaebd1f459a7e714ac498af428
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.StackTrace.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Diagnostics.StackTrace.dll
          • Size 45KB
          • SHA256 a035326a73e9d98862813d6be278cab8b43ca7d5cc22002014421d18b0860a41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.TraceSource.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Diagnostics.TraceSource.dll
          • Size 141KB
          • SHA256 b1b02e2cb4cd17187c3825f28bec194ea0ee031f87a5cd97656efba3aad758b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.IO.Packaging.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.IO.Packaging.dll
          • Size 285KB
          • SHA256 7810f7a228adc09b24b0df757b80a1e90658986633908f563487b4bb24cfd296
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Linq.dll
          • Size 529KB
          • SHA256 ad19451aa60c394640b7bf5950102f948c08b61b1d496e4f10d897449f4b18e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Memory.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Memory.dll
          • Size 153KB
          • SHA256 fd29c91ec1ae5ec2d98ad77f2863da6d583a3be596a1813959d02877cde057a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Net.Primitives.dll
          • Size 225KB
          • SHA256 c0f3f88d0c53bb6d89c172d019c6434fe48a814aca061cf1ae0ddfbe7a98e793
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.Requests.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Net.Requests.dll
          • Size 337KB
          • SHA256 35c16d93e024728e149015717008514aeb2fe4713d7ef304b5915cf834ee99fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.WebClient.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Net.WebClient.dll
          • Size 165KB
          • SHA256 afc3a8d9fccb72ccc85eedfbba579f63428a4e7acf7c49a43114bc97346acfce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Net.WebHeaderCollection.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Net.WebHeaderCollection.dll
          • Size 65KB
          • SHA256 ba6ffe6e59b62a9392e39f0d087d1596c0f0eab269311ca97bf2e512cc2aa376
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ObjectModel.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.ObjectModel.dll
          • Size 77KB
          • SHA256 e21ff10bdf7f9f1c035d9ab1bebde797611061bf50f9a4f42e8f370a3a8e859a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 8c01f630bb23c2fb142e6559cdcdf147105625defb36107019d4ab50d8854cd3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.Uri.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Private.Uri.dll
          • Size 253KB
          • SHA256 11a057d20d67f3944319094ecd1b08ebdc569ff01c0c66899d9f04e64fb02aa1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.Xml.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Private.Xml.dll
          • Size 7.6MB
          • SHA256 d85c7103bd4ae932d5ba07f53ac357bce11d09ff72804b78caf46f7657c7edc8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.CompilerServices.VisualC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Runtime.CompilerServices.VisualC.dll
          • Size 29KB
          • SHA256 01e20cb1e6a26cd2e77e55ff4d4fad896f37a894aab0f74158a53242dfe6378a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Runtime.InteropServices.dll
          • Size 93KB
          • SHA256 570a8140b838042a5d1135d5a20e39d18ccbfce13395c73b0b5bea935d311ea0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Security.Cryptography.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Security.Cryptography.dll
          • Size 2.0MB
          • SHA256 5d516c9da108647fdf6f96b5926b59f497b4f0ae84a932512e1e4203c49aa5d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Threading.dll
          • Size 81KB
          • SHA256 baad7f0d2f3ef9a7b4ed7646093464edddbee0937f33de71be139a01a86375ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Windows.Extensions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Windows.Extensions.dll
          • Size 113KB
          • SHA256 91e8a2838ef87192f188f4e663f1ff2d1932683522aebfa8cb36af4c2ea3d7dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Xaml.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\System.Xaml.dll
          • Size 1.4MB
          • SHA256 ddb468276fd2bc25651864fbb2595a59c35dcb2952204c81be4995a09a027216
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UIAutomationProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\UIAutomationProvider.dll
          • Size 57KB
          • SHA256 7c58044fc21d4677f51ec99e426e1ca6fc327f6e105f806bfdad2d303cbdce73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UIAutomationTypes.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\UIAutomationTypes.dll
          • Size 305KB
          • SHA256 6617b7ce8e57c0bf4529490601d3e99ad8c91824e303f357e6b9148d04281c42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsBase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\WindowsBase.dll
          • Size 2.2MB
          • SHA256 1fc324d4d92ceedf364ac0506c2506c41a87a6578826e714394596529bd23321
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wpfgfx_cor3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.net\RipehookLoader\AEyfMP-zwcUa\wpfgfx_cor3.dll
          • Size 1.9MB
          • SHA256 cc40e27a3a7e14dd4a8c423081fa367406e093be1dc79759e56d828e140bc014
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download