Analysis
- user interaction
yes - max time kernel
99s - max time network
21s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
24/08/2026, 03:18
General
- Target loader.exe
- Size 93.3MB
- Sample260824-dtvxwaself
- SHA256 cbc25da91d5a1627173af04fa4fb6a89b84903b5c5966835f2bac14682b7a839
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5488-0-0x000002147E412000-0x000002147E413000-memory.dmp
memory/5488-1-0x000002147E410000-0x000002147E411000-memory.dmp
memory/5488-3-0x000002147E414000-0x000002147E415000-memory.dmp
memory/5488-2-0x000002147E413000-0x000002147E414000-memory.dmp
memory/5488-5-0x000002147E411000-0x000002147E412000-memory.dmp
memory/5488-4-0x000002147E415000-0x000002147E416000-memory.dmp
memory/5488-6-0x000002147E417000-0x000002147E418000-memory.dmp
memory/5488-14-0x000002147E418000-0x000002147E41A000-memory.dmp
memory/5488-13-0x000002147E416000-0x000002147E417000-memory.dmp
memory/5488-25-0x000002147E41A000-0x000002147E41C000-memory.dmp
memory/5488-28-0x000002147E412000-0x000002147E413000-memory.dmp
memory/5488-27-0x000002147E41C000-0x000002147E41D000-memory.dmp
memory/5488-41-0x000002147E41E000-0x000002147E420000-memory.dmp
memory/5488-43-0x000002147E414000-0x000002147E415000-memory.dmp
memory/5488-44-0x000002147E421000-0x000002147E422000-memory.dmp
memory/5488-45-0x000002147E422000-0x000002147E423000-memory.dmp
memory/5488-42-0x000002147E420000-0x000002147E421000-memory.dmp
memory/5488-40-0x000002147E41D000-0x000002147E41E000-memory.dmp
memory/5488-46-0x000002147E423000-0x000002147E424000-memory.dmp
memory/5488-47-0x000002147E424000-0x000002147E425000-memory.dmp
memory/5488-48-0x000002147E417000-0x000002147E418000-memory.dmp
memory/5488-49-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-50-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-51-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-61-0x000002147E42F000-0x000002147E430000-memory.dmp
memory/5488-60-0x000002147E42E000-0x000002147E42F000-memory.dmp
memory/5488-59-0x000002147E42D000-0x000002147E42E000-memory.dmp
memory/5488-58-0x000002147E42C000-0x000002147E42D000-memory.dmp
memory/5488-57-0x000002147E42B000-0x000002147E42C000-memory.dmp
memory/5488-56-0x000002147E42A000-0x000002147E42B000-memory.dmp
memory/5488-55-0x000002147E429000-0x000002147E42A000-memory.dmp
memory/5488-54-0x000002147E428000-0x000002147E429000-memory.dmp
memory/5488-53-0x000002147E426000-0x000002147E427000-memory.dmp
memory/5488-52-0x000002147E427000-0x000002147E428000-memory.dmp
memory/5488-62-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-63-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-75-0x000002147E430000-0x000002147E431000-memory.dmp
memory/5488-76-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-77-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-79-0x00000214BE40D000-0x00000214BE40E000-memory.dmp
memory/5488-78-0x000002147E431000-0x000002147E434000-memory.dmp
memory/5488-80-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-81-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-82-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-83-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-85-0x00000214BE40E000-0x00000214BE40F000-memory.dmp
memory/5488-84-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-86-0x0000021478000000-0x0000021479000000-memory.dmp
memory/5488-87-0x0000021478000000-0x0000021479000000-memory.dmp