a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 18.0MB
Sample260804-cnbflsen3v
SHA256 a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c
MD5 fc4c13973d35400640794fef290476ab
SHA1 1f363819b1644942838c972be35ed95e42defee7
SHA512 acbd0e53b324f8d5ffc086b63eaf8535bd60590dbeab9ba26c910fbcd3d6e5d977465e9e3a65501d030be0850853e1cd4777b5d707bd191fe2726b2d03599d6a
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Yw:ee3Zqd5My9lqnSw
TLSH
T1B71712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3532	loader.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3068	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	loader.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5396	loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1212	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	loader.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302831885820162"	loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	powershell.exe
3068	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5396	loader.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5396	loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	5396	loader.exe
Token: SeDebugPrivilege	3068	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 3532	5396	loader.exe	89
PID 3532 wrote to memory of 1212	3532	loader.exe	90
PID 1212 wrote to memory of 3068	1212	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 18.0MB
SHA256 b12914b8eec0bc86abe8a7a582223a21c13aa793936bc6a3ee13faf45e51544d
MD5 0dc1eeb88aff964deb7851a5789c2570
SHA1 e9a81b4e3509c4fd1e7503105582418fd6123972
SHA512 38be29c48465e58545b7e4138d5b25562324647fb283a3897425c6b4f3304a56d139a986c1f51696baf92a364cb4c7a65e2490fbf02fa7a2e677d244e693e1f3
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Ywg:ee3Zqd5My9lqnSwg
TLSH
T1731712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 18.0MB
SHA256 6404fc92f230bfb1e0683ed8bab7451368052e6b7561a25ca1d7181b17765bcf
MD5 c95b77651e61645d564637ee02ce466d
SHA1 e42ad5835e6ea430184206bc1acdbf733e7cd27a
SHA512 11f4eada0cf86e71a3708c9ae85fa58e798c765f4dacd2b5390349401409311caf9f7c5b04e280ab6985102edccc2eb314647bf4389901f52301f5ea28938fcc
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6YwF:ee3Zqd5My9lqnSwF
TLSH
T1341712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3068-78-0x000001F2829A0000-0x000001F2829C2000-memory.dmp

Download

memory/3068-80-0x000001F29B410000-0x000001F29B532000-memory.dmp

Download

memory/3532-35-0x00007FF67BCC0000-0x00007FF67DEAB000-memory.dmp

Download

memory/3532-79-0x00007FF67BCC0000-0x00007FF67DEAB000-memory.dmp

Download

memory/5396-2-0x00007FF6ED020000-0x00007FF6EF20B000-memory.dmp

Download

memory/5396-34-0x00007FF6ED020000-0x00007FF6EF20B000-memory.dmp

Download