Analysis
- user interaction
yes - max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 04:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loker.ses.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
loker.ses.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target loker.ses.exe
- Size 3.5MB
- Sample260818-fbda8afd44
- SHA256 7764299681d941b444a48fac1ba7bd737e25b2dd2a297eebdd86fba7b7b2acbb
- MD5 b5d9a61c4b44abe10e4bffe04b59dfaf
- SHA1 656842b9183eaed7f1d10f7fcd5fa093ed6ac15c
- SHA512 e35d3488b2524e05111d5eeff88091b276421be5b0185c8693f1e43486b501a01845e3c03e871851668e6be51077de473f0d4b9607ff9bb9fc05587c72ee871a
- SSDEEP 49152:CyFAGiD3CguD5P5gVgwJyJDdh/qNwffAj3g/bTqSk62OF7UQ/S:CIAZ3CrDRJj/lgQ/6STq
- TLSH T1CA06CF0BF3A246D9D6669178C126A353E6B1B418173083DF2BE10966EF876F09FF9701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2828 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2828 taskmgr.exe Token: SeSystemProfilePrivilege 2828 taskmgr.exe Token: SeCreateGlobalPrivilege 2828 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe 2828 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loker.ses.exe"C:\Users\Admin\AppData\Local\Temp\loker.ses.exe"1⤵PID:4384
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2828