Overview

overview

6

Static

static

3

loader2.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    56s
  • max time network
    60s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    loader2.exe
  • Size 1.1MB
  • Sample260819-2vrhvavfma
  • SHA256 7ca7e5cf7fcc712bc3fcf07900066879c771642563c6d192bbb4fc234b3e8af9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader2.exe
    "C:\Users\Admin\AppData\Local\Temp\loader2.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=loader2.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4004.4624.4296314210008161270 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:5288
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView /prefetch:4 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x110,0x7ffc6d965fd8,0x7ffc6d965fe4,0x7ffc6d965ff0
        3⤵
          PID:4564
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=loader2.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,15604055377943340986,7780723459109953723,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
          3⤵
            PID:5512
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=loader2.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1904 --field-trial-handle=1760,i,15604055377943340986,7780723459109953723,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
            3⤵
              PID:4608
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=loader2.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2468 --field-trial-handle=1760,i,15604055377943340986,7780723459109953723,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
              3⤵
                PID:3592
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=loader2.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3264 --field-trial-handle=1760,i,15604055377943340986,7780723459109953723,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e /prefetch:1
                3⤵
                  PID:2788

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  app.js
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_ui_00000fa4\app.js
                  • Size 22KB
                  • SHA256 56a092e81d3ba791fa921a34ad826f2390cd863f84a6786d67ce1fa6fc34c7bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.html
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_ui_00000fa4\index.html
                  • Size 174KB
                  • SHA256 e03fadfeb504c03c4eb0b2eeac884791765e351c2260f736fb28a4a8d95f50dd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  styles.css
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_ui_00000fa4\styles.css
                  • Size 30KB
                  • SHA256 91c136796e21f46bf14d3ec01d0da75ed144468dd317ac3d02f3e45c48793041
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 cc46fbd1fe6782fd514d9b9110eb42347add48e688bba95c2ce02d7a01292e3e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 26a2dd4bd94db6468d213acf1c4d5d4b5a05d9c8dc51370d0c87dfe7bc30fd1f
                  • MD5 SHA1 SHA512
                  Submit Download

                  throttle_store.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad\throttle_store.dat
                  • Size 20B
                  • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                  • Size 72B
                  • SHA256 9e8adb5f890e599f1ee47b2796512953a955b9bdf5ecee46f1831ec325f7e220
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe59f841.TMP
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59f841.TMP
                  • Size 48B
                  • SHA256 44bd1905d54b6672e6eac171e0c8f2b8dc8b93fed7c8fe017b019a0218934459
                  • MD5 SHA1 SHA512
                  Submit Download

                  000001.dbtmp
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Extension Rules\000001.dbtmp
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\GPUCache\data_1
                  • Size 264KB
                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  da070862-e50e-432f-b63e-f63ddc7ea884.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\da070862-e50e-432f-b63e-f63ddc7ea884.tmp
                  • Size 6KB
                  • SHA256 8742f3afe56bdb6b59c5960e4e8b6ddd5591571e2e6dfcad25e0dfbf7f6189d2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\GraphiteDawnCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\GraphiteDawnCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\GraphiteDawnCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State
                  • Size 2KB
                  • SHA256 95ab7c413c3edd07f96ee8b25699d2055b47c30ddbb908de5192e75bfe2333b5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State
                  • Size 3KB
                  • SHA256 1ee475950803708f6fde5fe0fa4bda42a546b408bb82054877ebc92b4b09e431
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State
                  • Size 15KB
                  • SHA256 77cfd9cef881f53185cb276f6b80e7227bf8015941ba6c062ded9c619dd44a62
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State~RFe59a81d.TMP
                  • Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State~RFe59a81d.TMP
                  • Size 1KB
                  • SHA256 e32af60fd536e729d80b1a98838856bc3578ddebbbf849a1f202c845c5a7bea5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/2788-34-0x00007FFC8F360000-0x00007FFC8F361000-memory.dmp
                  Download

                  memory/5512-27-0x00007FFC8F360000-0x00007FFC8F361000-memory.dmp
                  Download