Analysis
- user interaction
yes - max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Loader.exe
- Size 1.4MB
- Sample260822-ql62dsvcmf
- SHA256 d0e27483216a7d895159b52e74eb4b127b57384ba05decfd33e4ad7e6f23bfaf
- MD5 97f66c14de62a53f8f899db144f0eaec
- SHA1 6891369585a5b54028c43ae444e48ed047e8dd0b
- SHA512 a79cca38811b6e7cdd8d182fde011756b1ec5f9f29ba68e68f3c3e68ce2dc8d4c7cf264d49d732e6b5b83aa89d1c45d6fc656cba5333ec416c5fe5d934b80641
- SSDEEP 24576:XrxobeKT11YOTVVddBrXrqy7y10RUL32aGiAJrayRKxh0lhSMXle2ugy0+O93l0x:OZT1Zrd7X60UL32aGiAJrayRKYPz+O9i
- TLSH T16365AE17A7A414F9C17BC138C6574A17E7B2781903219BEF13D09AA92F23AD16F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 4 api.ipify.org - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6084 cmd.exe 248 cmd.exe 5952 cmd.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3440 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 wmic.exe 4960 wmic.exe 4960 wmic.exe 4960 wmic.exe 4652 wmic.exe 4652 wmic.exe 4652 wmic.exe 4652 wmic.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe 2960 Loader.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4960 wmic.exe Token: SeSecurityPrivilege 4960 wmic.exe Token: SeTakeOwnershipPrivilege 4960 wmic.exe Token: SeLoadDriverPrivilege 4960 wmic.exe Token: SeSystemProfilePrivilege 4960 wmic.exe Token: SeSystemtimePrivilege 4960 wmic.exe Token: SeProfSingleProcessPrivilege 4960 wmic.exe Token: SeIncBasePriorityPrivilege 4960 wmic.exe Token: SeCreatePagefilePrivilege 4960 wmic.exe Token: SeBackupPrivilege 4960 wmic.exe Token: SeRestorePrivilege 4960 wmic.exe Token: SeShutdownPrivilege 4960 wmic.exe Token: SeDebugPrivilege 4960 wmic.exe Token: SeSystemEnvironmentPrivilege 4960 wmic.exe Token: SeRemoteShutdownPrivilege 4960 wmic.exe Token: SeUndockPrivilege 4960 wmic.exe Token: SeManageVolumePrivilege 4960 wmic.exe Token: 33 4960 wmic.exe Token: 34 4960 wmic.exe Token: 35 4960 wmic.exe Token: 36 4960 wmic.exe Token: SeIncreaseQuotaPrivilege 4960 wmic.exe Token: SeSecurityPrivilege 4960 wmic.exe Token: SeTakeOwnershipPrivilege 4960 wmic.exe Token: SeLoadDriverPrivilege 4960 wmic.exe Token: SeSystemProfilePrivilege 4960 wmic.exe Token: SeSystemtimePrivilege 4960 wmic.exe Token: SeProfSingleProcessPrivilege 4960 wmic.exe Token: SeIncBasePriorityPrivilege 4960 wmic.exe Token: SeCreatePagefilePrivilege 4960 wmic.exe Token: SeBackupPrivilege 4960 wmic.exe Token: SeRestorePrivilege 4960 wmic.exe Token: SeShutdownPrivilege 4960 wmic.exe Token: SeDebugPrivilege 4960 wmic.exe Token: SeSystemEnvironmentPrivilege 4960 wmic.exe Token: SeRemoteShutdownPrivilege 4960 wmic.exe Token: SeUndockPrivilege 4960 wmic.exe Token: SeManageVolumePrivilege 4960 wmic.exe Token: 33 4960 wmic.exe Token: 34 4960 wmic.exe Token: 35 4960 wmic.exe Token: 36 4960 wmic.exe Token: SeIncreaseQuotaPrivilege 4652 wmic.exe Token: SeSecurityPrivilege 4652 wmic.exe Token: SeTakeOwnershipPrivilege 4652 wmic.exe Token: SeLoadDriverPrivilege 4652 wmic.exe Token: SeSystemProfilePrivilege 4652 wmic.exe Token: SeSystemtimePrivilege 4652 wmic.exe Token: SeProfSingleProcessPrivilege 4652 wmic.exe Token: SeIncBasePriorityPrivilege 4652 wmic.exe Token: SeCreatePagefilePrivilege 4652 wmic.exe Token: SeBackupPrivilege 4652 wmic.exe Token: SeRestorePrivilege 4652 wmic.exe Token: SeShutdownPrivilege 4652 wmic.exe Token: SeDebugPrivilege 4652 wmic.exe Token: SeSystemEnvironmentPrivilege 4652 wmic.exe Token: SeRemoteShutdownPrivilege 4652 wmic.exe Token: SeUndockPrivilege 4652 wmic.exe Token: SeManageVolumePrivilege 4652 wmic.exe Token: 33 4652 wmic.exe Token: 34 4652 wmic.exe Token: 35 4652 wmic.exe Token: 36 4652 wmic.exe Token: SeIncreaseQuotaPrivilege 4652 wmic.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2960 wrote to memory of 4960 2960 Loader.exe 89 PID 2960 wrote to memory of 4652 2960 Loader.exe 93 PID 2960 wrote to memory of 6084 2960 Loader.exe 95 PID 6084 wrote to memory of 812 6084 cmd.exe 96 PID 6084 wrote to memory of 2632 6084 cmd.exe 97 PID 6084 wrote to memory of 4752 6084 cmd.exe 98 PID 2960 wrote to memory of 248 2960 Loader.exe 99 PID 248 wrote to memory of 5952 248 cmd.exe 100 PID 5952 wrote to memory of 3440 5952 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD53⤵PID:812
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2632
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:3440
-
-
-