Overview

overview

7

Static

static

3

ExLoader_I...er.exe

windows10-2004-x64

7

ExLoader_I...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ExLoader_Installer.exe
  • Size 22.2MB
  • Sample260821-eccweafr41
  • SHA256 59d78963e8f56b25b95c18d5c672789ddb62ee0e186eda49250cef99edad78b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3920

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ExLoader_Installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
        • Size 160KB
        • SHA256 bec2ae84b937f42e78e99f5ac5834dacdec818cd843d34eb603749f8ac48b62b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        audioplayers_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\audioplayers_windows_plugin.dll
        • Size 199KB
        • SHA256 132c0a4ab39e030baa937e20f170c6b0d446e3b1ce07e99375023c1773d60c15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.so
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so
        • Size 19.1MB
        • SHA256 ca4ef02c6f55922b4ca575406816a3e10876ce40e431be2e652dc25d17140404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AssetManifest.bin
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin
        • Size 9KB
        • SHA256 c8b72a7552f25f2b9d28ca794fc8a5a62715414ee2d151a85441482dd944c4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FontManifest.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json
        • Size 332B
        • SHA256 9e0903a9ceb64e32f7a139a143324252aae77dc58dbefb1f211fe03aa33460db
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        NativeAssetsManifest.json
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\NativeAssetsManifest.json
        • Size 45B
        • SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
        • MD5 SHA1 SHA512
        Submit Download

        Warcraft.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\backgrounds\Warcraft.jpg
        • Size 98KB
        • SHA256 f88b682b452ad60cf3803cefe5c5c992db9688d47e550d757fa9c2d2114e72ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NoirPro-Bold.otf
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Bold.otf
        • Size 46KB
        • SHA256 b012d85155925bbe2106b20234b96522dec7914f03b09bc6e2fff71554f31bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NoirPro-Light.otf
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Light.otf
        • Size 45KB
        • SHA256 3c9ef459625f995c62b993b64da299204b741e153ba8e6d988463aaa86b1aa44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NoirPro-Medium.otf
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Medium.otf
        • Size 46KB
        • SHA256 a728e91375dcadbdf6ef6d7e3cd0bbf5c56fb992d5b1be6640b83214c9d015ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NoirPro-Regular.otf
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-Regular.otf
        • Size 45KB
        • SHA256 c7fc6d9f2ff611073fa09a6c61a8c086da0ebe8da841a9f4ec4087a3e9b52152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NoirPro-SemiBold.otf
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\fonts\NoirPro-SemiBold.otf
        • Size 46KB
        • SHA256 50000ce2f0f8bf3018f1d04aa5c6716583b808ca05c802c46a9de4f084a91f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        grain.png
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\images\grain.png
        • Size 79KB
        • SHA256 cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        background_image.frag
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\background_image.frag
        • Size 13KB
        • SHA256 9986d66db87b6ab3ee7182a688736c411459c0ac4f583e966fe529d685c15a80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        modification_card_image.frag
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\modification_card_image.frag
        • Size 30KB
        • SHA256 880e1a838aa9b41af69fdfaf54a2a5f2ab0d60cf75d0df91acc3e8dd101c16cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        raindrops.frag
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\raindrops.frag
        • Size 51KB
        • SHA256 e139581178d563fc75aca12781a47e75c9020e13de3581273f901715afb691bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shimmer_effect.frag
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\shimmer_effect.frag
        • Size 7KB
        • SHA256 fb4e69dedfd10f3690e863547a9a50567a1e2ab6c35ee7e56a3fa3dee7263de1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winter.frag
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\shaders\winter.frag
        • Size 70KB
        • SHA256 43373bf6ccc11cf8a96ce00bc33bd0f20ff116b057a587557b4279a2b23edd54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat
        • Size 760KB
        • SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
        • Size 18.2MB
        • SHA256 f305282174da15723cee0913d805db06accb0b0de513fbd313affc9b173353ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll
        • Size 559KB
        • SHA256 1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        permission_handler_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\permission_handler_windows_plugin.dll
        • Size 115KB
        • SHA256 67465687870f83f264c090105385217c2addbf01781b56a239b79956ffe2a49b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        url_launcher_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\url_launcher_windows_plugin.dll
        • Size 96KB
        • SHA256 9ff8c50b5dd18205126d7ead03ae7d7332e3b85cd450aa2656a04321ff888d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shared_preferences.json
        • Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
        • Size 144B
        • SHA256 0b5b84897f233b6ff4242efc80a19136c8bf41e258fc68bf0b3948e442e11448
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3920-450-0x0000020A126E0000-0x0000020A139FD000-memory.dmp
        Download

        memory/3920-449-0x0000020A126E0000-0x0000020A139FD000-memory.dmp
        Download

        memory/3920-448-0x0000020A126E0000-0x0000020A139FD000-memory.dmp
        Download

        memory/3920-447-0x0000020A0F8B0000-0x0000020A0F8B1000-memory.dmp
        Download

        memory/3920-451-0x0000020A0F8C0000-0x0000020A0F8C1000-memory.dmp
        Download