Overview

overview

7

Static

static

3

loader.exe

windows11-21h2-x64

7

Resubmissions

07/08/2026, 01:47

260807-b7kmysvgmb

07/08/2026, 01:41

260807-b4ktjsdd837

Analysis

  • user interaction
    yes
  • max time kernel
    161s
  • max time network
    163s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/08/2026, 01:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    loader.exe
  • Size 18.0MB
  • Sample260807-b4ktjsdd83
  • SHA256 a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitexecutionpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Users\Admin\AppData\Local\Temp\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\loader.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:892
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2560
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:4792
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2540
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3308
      • C:\Windows\System32\8nuvyq.exe
        "C:\Windows\System32\8nuvyq.exe"
        1⤵
          PID:3404
        • C:\Windows\System32\8nuvyq.exe
          "C:\Windows\System32\8nuvyq.exe"
          1⤵
            PID:3796
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SDRSVC
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1704

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                __PSScriptPolicyTest_sp5yyuc0.voh.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sp5yyuc0.voh.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                loader.exe
                • Path C:\Users\Admin\AppData\Local\Temp\loader.exe
                • Size 18.0MB
                • SHA256 574cc37b0835279dd891acf5022dd690cd6ce3bc5e42cbf30a45019b45eab4e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/892-23-0x00007FF6431F0000-0x00007FF6453DB000-memory.dmp
                Download

                memory/892-9-0x00007FF6431F0000-0x00007FF6453DB000-memory.dmp
                Download

                memory/1020-7-0x00007FF652160000-0x00007FF65434B000-memory.dmp
                Download

                memory/1020-0-0x00007FF652160000-0x00007FF65434B000-memory.dmp
                Download

                memory/2540-29-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-27-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-28-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-33-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-39-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-38-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-37-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-36-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-35-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-34-0x000001CF4B620000-0x000001CF4B621000-memory.dmp
                Download

                memory/2540-41-0x000001CF4B200000-0x000001CF4B210000-memory.dmp
                Download

                memory/2540-49-0x000001CF4B280000-0x000001CF4B290000-memory.dmp
                Download

                memory/2560-18-0x00000254DC900000-0x00000254DC922000-memory.dmp
                Download