Analysis
- max time kernel
59s - max time network
64s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/08/2026, 02:56
General
- Target Loader.exe
- Size 93.3MB
- Sample260816-dfenqscj8x
- SHA256 d8a4c13feae3d090348936009ad9704acee2ef837f2e03e4e1ee160132911c64
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4244-1-0x000002AFF5BE0000-0x000002AFF5BE1000-memory.dmp
memory/4244-0-0x000002AFF5BE2000-0x000002AFF5BE3000-memory.dmp
memory/4244-14-0x000002AFF5BE6000-0x000002AFF5BE7000-memory.dmp
memory/4244-12-0x000002AFF5BE7000-0x000002AFF5BE8000-memory.dmp
memory/4244-11-0x000002AFF5BE1000-0x000002AFF5BE2000-memory.dmp
memory/4244-10-0x000002AFF5BE5000-0x000002AFF5BE6000-memory.dmp
memory/4244-25-0x000002B035BDD000-0x000002B035BDE000-memory.dmp
memory/4244-24-0x000002AFF5BE8000-0x000002AFF5BEA000-memory.dmp
memory/4244-23-0x000002AFF5BEA000-0x000002AFF5BEB000-memory.dmp
memory/4244-22-0x000002B035BDE000-0x000002B035BDF000-memory.dmp
memory/4244-35-0x000002AFF5BEB000-0x000002AFF5BEC000-memory.dmp
memory/4244-43-0x000002AFF5BEE000-0x000002AFF5BEF000-memory.dmp
memory/4244-44-0x000002AFF5BF0000-0x000002AFF5BF1000-memory.dmp
memory/4244-46-0x000002AFF5BE2000-0x000002AFF5BE3000-memory.dmp
memory/4244-45-0x000002AFF5BEF000-0x000002AFF5BF0000-memory.dmp
memory/4244-42-0x000002AFF5BED000-0x000002AFF5BEE000-memory.dmp
memory/4244-41-0x000002AFF5BEC000-0x000002AFF5BED000-memory.dmp
memory/4244-9-0x000002AFF5BE4000-0x000002AFF5BE5000-memory.dmp
memory/4244-8-0x000002AFF5BE3000-0x000002AFF5BE4000-memory.dmp
memory/4244-47-0x000002AFF5BF1000-0x000002AFF5BF2000-memory.dmp
memory/4244-48-0x000002B035BDC000-0x000002B035BDD000-memory.dmp
memory/4244-50-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-49-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-51-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-55-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-56-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-66-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-72-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-75-0x000002AFF5C02000-0x000002AFF5C03000-memory.dmp
memory/4244-74-0x000002AFF5BFD000-0x000002AFF5BFF000-memory.dmp
memory/4244-73-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-71-0x000002AFF5BF2000-0x000002AFF5BF3000-memory.dmp
memory/4244-70-0x000002B035BDD000-0x000002B035BDE000-memory.dmp
memory/4244-69-0x000002AFF5C00000-0x000002AFF5C02000-memory.dmp
memory/4244-68-0x000002AFF5BFC000-0x000002AFF5BFD000-memory.dmp
memory/4244-89-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-94-0x000002AFF5BEB000-0x000002AFF5BEC000-memory.dmp
memory/4244-93-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-92-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-91-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-90-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-88-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-87-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-67-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-65-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-64-0x000002AFF5BFB000-0x000002AFF5BFC000-memory.dmp
memory/4244-63-0x000002AFF5BFA000-0x000002AFF5BFB000-memory.dmp
memory/4244-62-0x000002AFF5BF9000-0x000002AFF5BFA000-memory.dmp
memory/4244-61-0x000002AFF5BF8000-0x000002AFF5BF9000-memory.dmp
memory/4244-60-0x000002AFF5BF7000-0x000002AFF5BF8000-memory.dmp
memory/4244-59-0x000002AFF5BF6000-0x000002AFF5BF7000-memory.dmp
memory/4244-58-0x000002AFF5BF5000-0x000002AFF5BF6000-memory.dmp
memory/4244-57-0x000002AFF5BF4000-0x000002AFF5BF5000-memory.dmp
memory/4244-54-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-53-0x000002AFF5BF3000-0x000002AFF5BF4000-memory.dmp
memory/4244-52-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-95-0x000002AFF5BEC000-0x000002AFF5BED000-memory.dmp
memory/4244-100-0x000002AFF5BF0000-0x000002AFF5BF1000-memory.dmp
memory/4244-99-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-98-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-97-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-96-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-101-0x000002AFF5BF1000-0x000002AFF5BF2000-memory.dmp
memory/4244-102-0x000002B035BDC000-0x000002B035BDD000-memory.dmp
memory/4244-103-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-104-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-105-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-106-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-109-0x000002AFF5BF5000-0x000002AFF5BF6000-memory.dmp
memory/4244-108-0x000002AFE8000000-0x000002AFE8200000-memory.dmp
memory/4244-107-0x000002AFF5BF3000-0x000002AFF5BF4000-memory.dmp
memory/4244-110-0x000002AFF5C02000-0x000002AFF5C03000-memory.dmp
memory/4244-111-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-112-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-113-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-114-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-115-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-116-0x000002B035E00000-0x000002B036000000-memory.dmp
memory/4244-117-0x000002AFF5C03000-0x000002AFF5C05000-memory.dmp
memory/4244-118-0x000002AFF5C05000-0x000002AFF5C07000-memory.dmp