e99c3645c4e8e55b203c1d6f27b6499accc61add482db6ae2c1ec6c38c2ac53a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 410KB
Sample260823-g2xyzstdmg
SHA256 e99c3645c4e8e55b203c1d6f27b6499accc61add482db6ae2c1ec6c38c2ac53a
MD5 78fd36dd15a15aae3ae55bab0de77a0b
SHA1 1fc38cbc2da59baac4ed95588a11c1feca01952b
SHA512 9e6e1e472810687aa73d455086fffcdca1a558e39042a2667b9b5d29905443848d236ebcb50d4f1ef184bc3fc17aba062c6a54f409b6a6a9d22d39f7e8090bd9
SSDEEP 3072:+Tq3vBrImkaYbcfMl/ekBNN9agb/1l6IadhwH9avzTIKByvffEj+UqyVxU8:VvBrbe/e6jxl6IaTHbTImyX8jF1
TLSH
T1C9947D03E6B2D4A4C456C0B4970B9F524B63FC891B2165EF2BE035492FB9AE64F37325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	calc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 5956	4700	loader.exe	83
PID 5956 wrote to memory of 4944	5956	calc.exe	84

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads