Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target loader.exe
- Size 5.3MB
- Sample260807-ec2vjadg84
- SHA256 6ffe4b8060d232eb4a5a62dd9c3719e987a9863153cc460ad919c98d2458c058
- MD5 22b8912acaaae9a44748678b095c5867
- SHA1 a043a11313a3af156815765ba0d631c407f7f1a6
- SHA512 e17b4b0d52d9201d697d42aacd130d3a89d091b02f786f569493d308149f7b894186d9c7297baa5f46b9ef28ec7a0e2963f29c50c6a194403bf25fe19b8115a7
- SSDEEP 98304:YkrRlwLisY4jnIfFDfrmbzRBmPdc+cTna4NpAV8O5Hm+PIjrKQ2VS+XWkIX/2gbH:TrRK3Y8IdfrmbzXi8lOZA/BkmkKegD
- TLSH T1DC4633DA36C726FDE045CBB49501247D71D47FCA45A0CD492F89E922AC67B2EAF3A304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools loader.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion loader.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum loader.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum loader.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN loader.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID loader.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor loader.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe 3948 loader.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3948 loader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3948 loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3948