a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c

Resubmissions

28/08/2026, 02:58

260828-dgkalssgkc8

28/08/2026, 02:55

260828-dehn1asgje7

28/08/2026, 02:44

260828-c8lr3ssfpe7

Analysis

user interaction
yes
max time kernel
67s
max time network
67s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 18.0MB
Sample260828-c8lr3ssfpe
SHA256 a849e0c7741599b0fd60392d0eeb5d83e215f4f90795af60bf1ad20bd530cb9c
MD5 fc4c13973d35400640794fef290476ab
SHA1 1f363819b1644942838c972be35ed95e42defee7
SHA512 acbd0e53b324f8d5ffc086b63eaf8535bd60590dbeab9ba26c910fbcd3d6e5d977465e9e3a65501d030be0850853e1cd4777b5d707bd191fe2726b2d03599d6a
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Yw:ee3Zqd5My9lqnSw
TLSH
T1B71712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1380	loader.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3772	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	loader.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3464	loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4644	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	loader.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323587238966067"	loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	powershell.exe
3772	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3464	loader.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3464	loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3464	loader.exe
Token: SeDebugPrivilege	3772	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1380	3464	loader.exe	89
PID 1380 wrote to memory of 4644	1380	loader.exe	90
PID 4644 wrote to memory of 3772	4644	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 18.0MB
SHA256 9716025b36d1d0d36e77c59c6d73e88709b52c5caafb860b059278484e0aef54
MD5 abe446014f8f466a8c547c306579d90e
SHA1 38b59cecb127acba81af97706c6cb5be13daff41
SHA512 58a6304c6d2e12169132a0685d9e5e33b09a6446f720195ebf470137f7c56d4129adda4321c43c5c7a39bd5ec359593cf05c9679e3c2262880daa1cdf38ccf43
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Yw7:ee3Zqd5My9lqnSw7
TLSH
T1441712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 18.0MB
SHA256 f15612a405eda2a039776ca2f7e9e2302c1b080abb53aab499cf003d1c0b0ad2
MD5 2bf60e11339f6f1dece136f249b5df6c
SHA1 e076987a714a032bf96e43be92602de1558362a1
SHA512 eaf508bbc6fe28e34bfde81344a5a80f5b4377e2c6f64cfce96ad7feaaafb7f43b67fa6f8b7e394704ace3a14e6f279564fdd25f1567a213eec5b48427deadac
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Yw2:ee3Zqd5My9lqnSw2
TLSH
T1201712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-35-0x00007FF6D5470000-0x00007FF6D765B000-memory.dmp

Download

memory/1380-79-0x00007FF6D5470000-0x00007FF6D765B000-memory.dmp

Download

memory/3464-1-0x00007FF710520000-0x00007FF71270B000-memory.dmp

Download

memory/3464-34-0x00007FF710520000-0x00007FF71270B000-memory.dmp

Download

memory/3772-78-0x0000021BF8D90000-0x0000021BF8DB2000-memory.dmp

Download