c38a737c8712b3f682efd918f1825d4ea66dda508de59afc6199063a89045740

Analysis

max time kernel
16s
max time network
15s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loaderworld.ps1
Size 609KB
Sample260825-qb6ymsserg
SHA256 c38a737c8712b3f682efd918f1825d4ea66dda508de59afc6199063a89045740
MD5 79ed7591a6677ea168673250282148ad
SHA1 cc8c6eb9af271a42225f01fe8cf9f10e2d5c5e97
SHA512 c7da9cd06bc6e65a4e340a9ccf53b7d598854703106596dfa57c36cdfc857631a336b421b6c8a0c6fd3108f5e7b8e3c0f4e39a1f1f698f26330f8deaf7fb0851
SSDEEP 3072:dgvsczGcP5wIA1s7rgqGBobXexJi1S878FweHu/bFMpl9zb8YS16DcY9eHSBufdL:68rqGBoDsJi1S878FJuk9z06sdOQV
TLSH
T121D405C13B6CB1739FB40B0D72D70DAE42E4754D6EA93939A41DCA2F28B25C4499E0F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution ransomware

Malware Config

Signatures

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3768	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3768	PowerShell.exe
3768	PowerShell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3768	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	PowerShell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3768	PowerShell.exe
3768	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 1308	3768	PowerShell.exe	91
PID 1308 wrote to memory of 4792	1308	csc.exe	92
PID 3768 wrote to memory of 4168	3768	PowerShell.exe	93
PID 4168 wrote to memory of 4820	4168	csc.exe	94

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Loaderworld.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sln0acg2\sln0acg2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AF9.tmp" "c:\Users\Admin\AppData\Local\Temp\sln0acg2\CSC60424C7E399D417782CC112E93BAC49.TMP"
    3⤵
    PID:4792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ljhe2jum\ljhe2jum.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6383.tmp" "c:\Users\Admin\AppData\Local\Temp\ljhe2jum\CSCA6332FEEF9FF41BC8A616DB7205BB9C6.TMP"
    3⤵
    PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4AF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4AF9.tmp
Size 1KB
SHA256 dbf2c68c705f45b1402d1f0d62dafeb0ea1e9f9ca2d8d5b616dd545366be24b3
MD5 298cdb58f4b1fea46fb91bc0b7c9bd82
SHA1 188ec34596855726c1aecf1065b71605e106ac21
SHA512 77624878749ef26caa9d0a46f082e7c51e650a81f0617a17e38118856ee30b0e8c9a339a660588dffa89ff6f9614b5d1f9577e67f4d597fe0746a6973121a475
TLSH
T15A21EF0993F8471EF0774732ADFA432FA7B8FD64DFA2535A9540422D2C91604EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES6383.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6383.tmp
Size 1KB
SHA256 481785b108eb6e0c4830f148a10153b3c57d1d5b64e3057c0b8a936b2e28e7b8
MD5 dc163406f3edbc37ae5334d3e438aaea
SHA1 eda845351f520ff184f9435d6c9139f9963214e2
SHA512 2a844de874b042a412a70cb7aa36ac33b4d68c7f2baba7c4b7cbf4f685b3a271afb3fa078a2b20eb2dc5b4c6cc39d986953a8791af5f8b4c19716be16f34ee57
TLSH
T1D7216A0593ED870FF073473269F6432B9275FD64EFA5975A858002282C51514EFA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

ljhe2jum.dll

Path C:\Users\Admin\AppData\Local\Temp\ljhe2jum\ljhe2jum.dll
Size 3KB
SHA256 b6dba4ab62d42c0fe09e15a5c9bc71fb0b440a0b202d2b48d8c98ea6ff9ad6fa
MD5 b385bcce8601ed9217a9f5e60ae5f830
SHA1 85d28063cde2ec82422bfc523ab7523330ac31ba
SHA512 ac5c34099ebb544d051a6f21bedc29bdf376fbcf998786377080ff97be46c1e3c2013461704608eb5ac2437fd5d27f9e7244cdd8fced1a0a405b565327db5650
TLSH
T1F051CC1AA3E9452BE5B707316EF3071663B4FC908B76976E18C00369AC512681E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

sln0acg2.dll

Path C:\Users\Admin\AppData\Local\Temp\sln0acg2\sln0acg2.dll
Size 3KB
SHA256 8a65db500f0bb5f9f250dbc215c075efa4eb8efece63adf6784d8083301d39cf
MD5 1e0d2cae5d362ad2d0d8af9e82412993
SHA1 3446b78e21c2ee337190786d2aac578104a19bc1
SHA512 6dedd22d6cbb73e85c0463a71ccfcace8f06651777745575312a3599c2e7cdb0f53cfc209f6466c58fe401c8f073cd524f4781676912e2e7f0346df7fd58dfac
TLSH
T1C851FB0A93E8462BE4730B30ADF3472A37B8FC509F73672E48804219ACA57245E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA6332FEEF9FF41BC8A616DB7205BB9C6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ljhe2jum\CSCA6332FEEF9FF41BC8A616DB7205BB9C6.TMP
Size 652B
SHA256 315052723ed656bc39d2ebc60ce1144348e85c44cb51bff13be8f07151466e2b
MD5 b03c1e1fecd218c9327ee386e7322b7e
SHA1 cb163c6e7d6613160bdb984d9aca01c3b3e13221
SHA512 a2526b52abcc607dcc0d7fd13b80fd4b07a1da3cf34429d9b5868924efdf2ce02010745155e9377f779f04af2d10ebf69106d4924ed811e8c5912cca92155af2
TLSH
T190F05E0A63F8420EF1F34B30BDF6836391A9BC65DE3293ED549003192C645209A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ljhe2jum.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ljhe2jum\ljhe2jum.0.cs
Size 316B
SHA256 ec280e5583d6d76c48e5aadce05a852c096b560d9fa293f58cc3a55ba965bee9
MD5 24a1bad852fb8e5990d8d7c3885c39df
SHA1 568f0def0f328e9e401f4c5a2c84c917d51756dc
SHA512 87bb012a32f56a22588ed98a8da12423dacc3699e995187d785f4909ed693d7283aff8a239cad8da2a58565e435bdac4e72c94841dceacc1561a4c97d0049396
TLSH
T1A3E0CDB977C79B2154074505798DA05FE75331A197FA5F02E39B0620DD8B009C335F29
MD5 SHA1 SHA512 TLSH

Submit Download

ljhe2jum.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ljhe2jum\ljhe2jum.cmdline
Size 369B
SHA256 9bcea697d1d317692495811360d70aba12e9ee36f98b4c17ee0bc267b560ad0d
MD5 a1eee82a26e206a572fcfc15b9d85000
SHA1 6807767271678e6fbad2b8aae47a5f1d0319ff44
SHA512 903e1756e60c79e2cfa7aeb7176a6f7c25d615f36a40b5fef5f6eda9750ee7a6a547c7a022986d5efb509ca044c64e2fb3f5d6d0f167231594a9a26bc52b32f9
TLSH
T1FDE0202A92D7C67E15DE1107226DC9ECCAF3074B2D817F985150445DD02710567D1765
MD5 SHA1 SHA512 TLSH

Submit Download

CSC60424C7E399D417782CC112E93BAC49.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\sln0acg2\CSC60424C7E399D417782CC112E93BAC49.TMP
Size 652B
SHA256 4c1bca42025feb2ebb56341411c62888dd5f246300f3f6fa214fdde2a19fbb34
MD5 89cbd621253f9972b10312b25c2f7ffe
SHA1 05e53e2dba4ec5cd2fbb646e63d4f9caedf4c1c1
SHA512 c58da5ab5c191d49cb026089f49c024d382af9b051b85cf581aaaf3d1896270afa38b5f24c6560e02a2e6b6435917577867fbb1764e4fc3430f6e5580763bdf4
TLSH
T164F0540963F8020EF0F34B30BDF5836395A8BC64DE3253ED5580131A18646109971F71
MD5 SHA1 SHA512 TLSH

Submit Download

sln0acg2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sln0acg2\sln0acg2.0.cs
Size 289B
SHA256 653db0e789c211da9508812458c3ea646761b62760d19be2997d349c3673afee
MD5 2dfa104ea733fa32063cbb6924aeba42
SHA1 cea2e4784b912dded633afec82c803793b76290f
SHA512 8d866cd95d01648bda04819d6bc8acf72b73a3f448d9853836f4724dc83b50536fd5f85448f907d6b4089232fbb9444150c0b8150e36802b77613729cef11df2
TLSH
T128D0C2146AB2EA704033841A8C8BD0BEB70BA466266A19007AA51310EF8B00A8225A5A
MD5 SHA1 SHA512 TLSH

Submit Download

sln0acg2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sln0acg2\sln0acg2.cmdline
Size 369B
SHA256 eac5a3c764024876f2dde967739a9aba3559f26e2d3556cf455541db27c4bb81
MD5 6f785da050b94f6911c6d3b8550e7243
SHA1 132cb473c72ab7789204dd2c1a810bb9e371c1cc
SHA512 8c10ff81f0c4b19587f88a270a727dc03b3e4dd3b3e0b8c11d6f9fdf70155c9828220830463c46ab11e526449d849c9075f37b6a879a04ec0d775d3ea55780df
TLSH
T1D5E0C02E4246CA7D55DD300725EFE5ACE67707432959BF8458C0448DF0F70002FD2741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3768-10-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-7-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-12-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-11-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-27-0x000001D423E30000-0x000001D423E38000-memory.dmp

Download

memory/3768-0-0x00007FFE3558F000-0x00007FFE35590000-memory.dmp

Download

memory/3768-28-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-9-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-8-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-29-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-17-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-16-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-6-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-5-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-4-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3768-3-0x000001D423DA0000-0x000001D423DC2000-memory.dmp

Download

memory/3768-42-0x000001D423E40000-0x000001D423E48000-memory.dmp

Download

memory/3768-44-0x000001DC28F10000-0x000001DC296B6000-memory.dmp

Download

memory/3768-46-0x000001D4040C0000-0x000001D4041C0000-memory.dmp

Download

memory/3768-48-0x000001D4040C0000-0x000001D4041C0000-memory.dmp

Download

memory/3768-47-0x000001D4040C0000-0x000001D4041C0000-memory.dmp

Download

memory/3768-50-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download