Overview

overview

7

Static

static

3

www_downlo...er.exe

windows10-2004-x64

1

www_downlo...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    60s
  • max time network
    59s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 03:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    www_download_gg__Loader.exe
  • Size 16.4MB
  • Sample260820-dv8v5ayfph
  • SHA256 6372d63bda93efddafc8a28f4498f0325847feb55fed096264a0dd3faab20d9f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\www_download_gg__Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\www_download_gg__Loader.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\um.exe
      "C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\um.exe" --probe-payload-contract "C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\nebula.dll"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4984
    • C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\um.exe
      "C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\um.exe" --probe-hv
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2936

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2b9b3b14-c77c-467b-af08-62b1b4234e5d.event.json
        • Path C:\Users\Admin\AppData\Local\Nebula\telemetry\pending\2b9b3b14-c77c-467b-af08-62b1b4234e5d.event.json
        • Size 1KB
        • SHA256 e73ff6b361bc44e68f854fedafc3daa0f2ed755765c6e2598e0bc623487d3f84
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9a432e7a-7a32-482e-bb0b-02b24134e96d.active.json
        • Path C:\Users\Admin\AppData\Local\Nebula\telemetry\pending\9a432e7a-7a32-482e-bb0b-02b24134e96d.active.json
        • Size 1KB
        • SHA256 7ba533c67d3d769aedcc3da36ff1f65f83a0b448567ed609fb90ec85015a9ffb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dbghelp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\dbghelp.dll
        • Size 2.2MB
        • SHA256 719a6a2443f713a3ff0dd722e6eedba0d83bd9ed158974f39215f120cc7315ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nebula.dll
        • Path C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\nebula.dll
        • Size 6.2MB
        • SHA256 c963e41677ed6789dc25f8fbcf864b5ddb1f9722229bf12abe9e23e1ae51aa8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        um.exe
        • Path C:\Users\Admin\AppData\Local\Temp\NebulaLoader-2024-b7045822c5333d554ab3da806492a4cc-0\um.exe
        • Size 585KB
        • SHA256 6f63919ed90be7a1155fa4393dca2f5645d0e1fadc7ef501ea7a053af635ceea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download