Overview

overview

7

Static

static

3

loader.exe

windows10-2004-x64

7

loader.exe

windows11-ltsc_2024-x64

7

Resubmissions

23/08/2026, 16:04

260823-thwm2ayala7

23/08/2026, 15:57

260823-tee6wahn3t7

Analysis

  • user interaction
    yes
  • max time kernel
    6s
  • max time network
    14s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 16:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    loader.exe
  • Size 66.4MB
  • Sample260823-thwm2ayala
  • SHA256 2223fe5ab7ab8d4b48c1885c3b46bc205ba2f61a1b2359146d20993446f53a92
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSES.chromium.html
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\LICENSES.chromium.html
        • Size 2.4MB
        • SHA256 5bfcfd7c15c797a961dcedb3f2b62296274e4159e09fa8e7fed2bdcb9a8b42f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\chrome_100_percent.pak
        • Size 132KB
        • SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\chrome_200_percent.pak
        • Size 190KB
        • SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\ffmpeg.dll
        • Size 2.8MB
        • SHA256 9d1eb0c6eb12bfa87e74a65c2fde5d61c4c93e21fb0800bbdccb6559527036a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\icudtl.dat
        • Size 2.6MB
        • SHA256 1c0a541f3244cb280e5c330ea561b0d763b03b7dfbed212440a4756a7d652244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\libEGL.dll
        • Size 477KB
        • SHA256 9cfc3001191e8b3eb9c96ba29e57e5bf9aaab264e83897e47cb968167a8a811b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\libGLESv2.dll
        • Size 1.9MB
        • SHA256 893ce31a182a4afe9408c21bdfe897227d8d9763274d7a160cf5bcc864a8a71f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\bg.pak
        • Size 828KB
        • SHA256 a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        el.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\el.pak
        • Size 907KB
        • SHA256 eb46d9860835b69d33b2583d1e52b20238b666b967bf00906424e3c8a161ed64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        es.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\es.pak
        • Size 495KB
        • SHA256 848d422be1b8fae74786ed6d6dfa7dd2e97b798b4a9ba1d929085e425b2a54e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\fr.pak
        • Size 537KB
        • SHA256 52aa0a18ace6347b06a89e3851a1b116812c022dbe41da8942278878b5409cee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ja.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\ja.pak
        • Size 598KB
        • SHA256 63ad3974baa8c160ba30448171f148d008ac19e80010fb13d3a65cf411b67ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\pl.pak
        • Size 521KB
        • SHA256 60aa08598a81bb46ddc64a5ab0852565554c6e6262e9c5dfee09f4e3fc08d5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sl.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\sl.pak
        • Size 506KB
        • SHA256 341c33514c627501026c3e5b9620cf0d9f482ab66b10a7e0fb112c7620b15600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\sr.pak
        • Size 780KB
        • SHA256 5a55320d6953efb5b565893e32e01f6dae781a16460df5502c8ba012c893edfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sv.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\sv.pak
        • Size 454KB
        • SHA256 e5cccdb241938f4a6b9af5a245abe0e0218c72e08a73db3ed0452c6ddfb9c379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sw.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\sw.pak
        • Size 479KB
        • SHA256 c18a209f8ec3641c90ea8ced5343f943f034e09c8e75466e24dcabc070d08804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ta.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\ta.pak
        • Size 960KB
        • SHA256 197a1fbc7d142665a731b27cb5541abe2cc34fe0ac8d207ef6b4cfacf1786ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        te.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\te.pak
        • Size 896KB
        • SHA256 85d68ae9dfbeecc963daf7d962cd3df783c5b41d01c9728ced6021d38ba4d92f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        th.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\th.pak
        • Size 896KB
        • SHA256 21faeecf2eaa535cee66af003ec7ed2b47ebe64e1c39758a67d7e493ee287e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tr.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\tr.pak
        • Size 489KB
        • SHA256 afcbf02420dc724059f70d1dc6ffa51f5dd75136d9e1e8671d92d5d14955edf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uk.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\uk.pak
        • Size 832KB
        • SHA256 e0f309bce1af2689e7e5fa8f95bfc8009d3d865d3390312bfcf0b2c6d8cd9b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ur.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\ur.pak
        • Size 732KB
        • SHA256 b9f22a23368bf1e21f3085583ecb775cce8045176721ff6ae798b06bd2810dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vi.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\vi.pak
        • Size 579KB
        • SHA256 f1458c4ce4ca708e849eb0c68a5157360ef003f3a9c95628d5ca12ada303b379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-CN.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\zh-CN.pak
        • Size 418KB
        • SHA256 0f8d42d7f0b0b01aafad6ae79f0bd0ca518b2db94287b09df088bc093f15f605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zh-TW.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\locales\zh-TW.pak
        • Size 414KB
        • SHA256 ff3a294fd1afb1fa7aaf53fbc4396643a12ed132633c5c86f14c16b88fa94a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\resources.pak
        • Size 2.2MB
        • SHA256 7d657cc9b37c85be231ec13472698209bac539865b47c647aa1b5aef1251dcb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\resources\app.asar
        • Size 832KB
        • SHA256 c936148fc10ff9b4b2c147f13d3e97f88612da8941e323905927c1c238f58cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevate.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\snapshot_blob.bin
        • Size 261KB
        • SHA256 2bceef4822ca7cc3add4a9dcb67c51efb51c656fce96a3b840250de15379959c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\vk_swiftshader.dll
        • Size 1.4MB
        • SHA256 940c5b2b005cdab0e04362729636535c9bc74a85c2a389b8a71cea7a0d345feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vk_swiftshader_icd.json
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\7z-out\vulkan-1.dll
        • Size 931KB
        • SHA256 3a433f9cbee4cc89ac58917f1872ee0f38ba451760d4bba6f37712f0c8179b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsj4CFE.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download