Analysis
- user interaction
yes - max time kernel
299s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
clarity_loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
clarity_loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target clarity_loader.exe
- Size 20.5MB
- Sample260910-apla4avwdy
- SHA256 35d7a7266444c553b01bf7b5e5126b8f63a895ece681c71238f7f5783999d51c
- MD5 c1a00334dbf6970953f0c2ba09511221
- SHA1 b0829215a40a6f4a7738209cde5329de41547f09
- SHA512 98eaa5ec612d9f70bcc064caa3841d3c726e5a2347d9a06a1e3a1b22c1da1dd3b829f9d54e44e89e8ac7a38898fb24c9acb0d2867fe42d82967770a36327cba1
- SSDEEP 393216:WVrzyGnuEx7qsrhFMQ3JpldRgd7SqwZTgNvASWeAzYnQMTBIWflTgwTxceGyB:IfxzrhF13ddepQTWvs8n5BIclkwTDB
- TLSH T1DC27332A2D8748D6DCC514B09F1FEBF623B25DE5068848352DC16DB7BDF0EB6702A486
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winrun17.bat clarity_loader.exe - Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 3648 clarity_loader.exe 3648 clarity_loader.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 3648 clarity_loader.exe 3648 clarity_loader.exe 3648 clarity_loader.exe 3648 clarity_loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 972 3648 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clarity_loader.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3648 clarity_loader.exe 3648 clarity_loader.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 3648 clarity_loader.exe 3648 clarity_loader.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 3648 clarity_loader.exe 3648 clarity_loader.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe 4236 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4236 svchost.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe Token: SeDebugPrivilege 3648 clarity_loader.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89 PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89 PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89 PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89 PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89 PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89 PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89 PID 3648 wrote to memory of 4236 3648 clarity_loader.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\clarity_loader.exe"C:\Users\Admin\AppData\Local\Temp\clarity_loader.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 17722⤵
- Program crash
PID:972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3648 -ip 36481⤵PID:3612