General
- Target loader.exe
- Size 34KB
- Sample260824-ag12ksbf34
- SHA256 946e205ec9956cfbd6366d50df18462b077289cd35f3b5478fdf7bb001f81501
- MD5 7cbc92070d125641267703b8797da08c
- SHA1 796ed021daaab15613adfa11c23189849565ea82
- SHA512 25277992f24483b2b892519f9bbac0670f99426d5f89700eed05df348012f093cbd0cf16686519534606cd3736401a017a5956180f89a5b689a2778d80492801
- SSDEEP 768:Y0UYTAT59oE06/XRoKC54MzFVetoqBSZzB:LAd9oERPCKW4MvetoF
- TLSH T1D5F2F84F739358EDC91AD178E5FA8371E9B1FC6209745E3E8350C2760E34A908A7DA4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target loader.exe
- Size 34KB
- SHA256 946e205ec9956cfbd6366d50df18462b077289cd35f3b5478fdf7bb001f81501
- MD5 7cbc92070d125641267703b8797da08c
- SHA1 796ed021daaab15613adfa11c23189849565ea82
- SHA512 25277992f24483b2b892519f9bbac0670f99426d5f89700eed05df348012f093cbd0cf16686519534606cd3736401a017a5956180f89a5b689a2778d80492801
- SSDEEP 768:Y0UYTAT59oE06/XRoKC54MzFVetoqBSZzB:LAd9oERPCKW4MvetoF
- TLSH T1D5F2F84F739358EDC91AD178E5FA8371E9B1FC6209745E3E8350C2760E34A908A7DA4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Grants admin privileges
Uses net.exe to modify the user's privileges.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Loads dropped DLL
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Account Manipulation
1Event Triggered Execution
1Component Object Model Hijacking
1