Analysis
- user interaction
yes - max time kernel
26s - max time network
28s - platform
windows11-21h2_x64 - resource
win11-20260513-de - resource tags
arch:x64arch:x86image:win11-20260513-delocale:de-deos:windows11-21h2-x64systemwindows - submitted
15/08/2026, 17:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win11-20260513-de
windows11-21h2-x64
10 signatures
150 seconds
General
- Target loader.exe
- Size 5.3MB
- Sample260815-vkxtjsel2v
- SHA256 6ffe4b8060d232eb4a5a62dd9c3719e987a9863153cc460ad919c98d2458c058
- MD5 22b8912acaaae9a44748678b095c5867
- SHA1 a043a11313a3af156815765ba0d631c407f7f1a6
- SHA512 e17b4b0d52d9201d697d42aacd130d3a89d091b02f786f569493d308149f7b894186d9c7297baa5f46b9ef28ec7a0e2963f29c50c6a194403bf25fe19b8115a7
- SSDEEP 98304:YkrRlwLisY4jnIfFDfrmbzRBmPdc+cTna4NpAV8O5Hm+PIjrKQ2VS+XWkIX/2gbH:TrRK3Y8IdfrmbzXi8lOZA/BkmkKegD
- TLSH T1DC4633DA36C726FDE045CBB49501247D71D47FCA45A0CD492F89E922AC67B2EAF3A304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools loader.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion loader.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum loader.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN loader.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID loader.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor loader.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe 1448 loader.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1448 loader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1448 loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1448