Analysis
- max time kernel
299s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 12:54
General
- Target loader.exe
- Size 12.2MB
- Sample260824-p5dnhsde33
- SHA256 c9c6b080c27464ff92c089487b471e25338fe5f4a74d5fbc62e4d6b374c1996e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell -Command "Get-PnpDevice -Class Display -Status Error,Disabled | ForEach-Object { Enable-PnpDevice -InstanceId $_.InstanceId -Confirm:$false }"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-PnpDevice -Class Display -Status Error,Disabled | ForEach-Object { Enable-PnpDevice -InstanceId $_.InstanceId -Confirm:$false }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4620-0-0x00007FF6EDAB1000-0x00007FF6EE179000-memory.dmp
memory/4620-1-0x00007FFCD1050000-0x00007FFCD1052000-memory.dmp
memory/4620-2-0x00007FF6ED8A0000-0x00007FF6EEDAC000-memory.dmp
memory/4620-35-0x00007FF6ED8A0000-0x00007FF6EEDAC000-memory.dmp
memory/4620-36-0x00007FF6EDAB1000-0x00007FF6EE179000-memory.dmp
memory/4768-21-0x00000278F3320000-0x00000278F33D2000-memory.dmp
memory/4768-23-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-12-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-13-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-14-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-15-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-16-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-17-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-20-0x00000278F3080000-0x00000278F309E000-memory.dmp
memory/4768-10-0x00000278F3010000-0x00000278F3032000-memory.dmp
memory/4768-22-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-11-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-24-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-25-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-26-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-27-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-28-0x00000278F2FF0000-0x00000278F2FFA000-memory.dmp
memory/4768-29-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-30-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-31-0x00000278F30C0000-0x00000278F30DE000-memory.dmp
memory/4768-32-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-34-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-9-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/4768-6-0x00007FFCAE0EF000-0x00007FFCAE0F0000-memory.dmp