Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 15:13
General
- Target internal loader.exe
- Size 286KB
- Sample260925-slt3yayflc
- SHA256 22dbc8f7ccbef08998b6db7e191656d897042dee58ead6ff01f72daed4886f2b
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\internal loader.exe"C:\Users\Admin\AppData\Local\Temp\internal loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4220-0-0x00007FFF86A4F000-0x00007FFF86A50000-memory.dmp
memory/4220-3-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-4-0x0000012941ED0000-0x0000012941EF2000-memory.dmp
memory/4220-5-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-6-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-9-0x0000012942190000-0x00000129421AE000-memory.dmp
memory/4220-11-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-10-0x00000129421B0000-0x0000012942262000-memory.dmp
memory/4220-12-0x0000012941F80000-0x0000012941F8A000-memory.dmp
memory/4220-13-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-14-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-15-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-16-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-17-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-18-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-19-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-20-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-21-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-22-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp
memory/4220-24-0x00007FFF868C0000-0x00007FFF87264000-memory.dmp