f3d3311ed76379db8bb8704aad760c728d1102325558526a9c423f67bc310e7c

Analysis

user interaction
yes
max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 5.2MB
Sample260926-trmfqaxyhs
SHA256 f3d3311ed76379db8bb8704aad760c728d1102325558526a9c423f67bc310e7c
MD5 3b3ab954dd5bc5cf77892cd7f4f9f549
SHA1 104ebfbfb7286b5160cf275a0b0c45e92cb4982e
SHA512 89e4e134b349464f3fe5ca5145a0f8185c35f6984c4404c5349424c16bf4e2402499911940fea9ab9e9cb5f92ea24c028270a1eb324c04dc79c1039a2748bb52
SSDEEP 98304:Xu0/nP2qpvcTXnj5klWJr8wUCagPs79MY5Ip1pEwLSzTSOr0ODMVK:Xu0/PhQS4QwGlM2IrpNLMZrSV
TLSH
T1D046337BFA2BEF55D25DB23872456D0330CE9A8C1D947700676EE0012A788F9BE5728D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2488	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	mountvol.exe
	\??\F:\	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4616	Loader.exe
4616	Loader.exe
4616	Loader.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4616-0-0x00007FF771720000-0x00007FF77244A000-memory.dmp	upx
behavioral2/memory/4616-26-0x00007FF771720000-0x00007FF77244A000-memory.dmp	upx
behavioral2/memory/4616-27-0x00007FF771720000-0x00007FF77244A000-memory.dmp	upx
behavioral2/memory/4616-29-0x00007FF771720000-0x00007FF77244A000-memory.dmp	upx
behavioral2/memory/4616-30-0x00007FF771720000-0x00007FF77244A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2488	powershell.exe
2488	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4616	Loader.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeIncreaseQuotaPrivilege	2488	powershell.exe
Token: SeSecurityPrivilege	2488	powershell.exe
Token: SeTakeOwnershipPrivilege	2488	powershell.exe
Token: SeLoadDriverPrivilege	2488	powershell.exe
Token: SeSystemProfilePrivilege	2488	powershell.exe
Token: SeSystemtimePrivilege	2488	powershell.exe
Token: SeProfSingleProcessPrivilege	2488	powershell.exe
Token: SeIncBasePriorityPrivilege	2488	powershell.exe
Token: SeCreatePagefilePrivilege	2488	powershell.exe
Token: SeBackupPrivilege	2488	powershell.exe
Token: SeRestorePrivilege	2488	powershell.exe
Token: SeShutdownPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeSystemEnvironmentPrivilege	2488	powershell.exe
Token: SeRemoteShutdownPrivilege	2488	powershell.exe
Token: SeUndockPrivilege	2488	powershell.exe
Token: SeManageVolumePrivilege	2488	powershell.exe
Token: 33	2488	powershell.exe
Token: 34	2488	powershell.exe
Token: 35	2488	powershell.exe
Token: 36	2488	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	Loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3816	4616	Loader.exe	90
PID 4616 wrote to memory of 5556	4616	Loader.exe	92
PID 4616 wrote to memory of 2488	4616	Loader.exe	94

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SYSTEM32\mountvol.exe
  mountvol X: /D
  2⤵
  - Enumerates connected drives
  PID:3816
- C:\Windows\SYSTEM32\mountvol.exe
  mountvol X: /S
  2⤵
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-17-0x000001C7A0B20000-0x000001C7A0B42000-memory.dmp

Download

memory/2488-20-0x000001C7A0CE0000-0x000001C7A0CFE000-memory.dmp

Download

memory/2488-21-0x000001C7A0D00000-0x000001C7A0DB2000-memory.dmp

Download

memory/2488-22-0x000001C7A0DC0000-0x000001C7A0DCA000-memory.dmp

Download

memory/4616-0-0x00007FF771720000-0x00007FF77244A000-memory.dmp

Download

memory/4616-8-0x0000020B994A0000-0x0000020B994A1000-memory.dmp

Download

memory/4616-9-0x0000020B994A0000-0x0000020B994A1000-memory.dmp

Download

memory/4616-26-0x00007FF771720000-0x00007FF77244A000-memory.dmp

Download

memory/4616-27-0x00007FF771720000-0x00007FF77244A000-memory.dmp

Download

memory/4616-29-0x00007FF771720000-0x00007FF77244A000-memory.dmp

Download

memory/4616-30-0x00007FF771720000-0x00007FF77244A000-memory.dmp

Download