8739a25945f9bcce6b50686a10ecca834aa2b201e724a5ebc79ef815b3db915b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 328KB
Sample261009-wheqmacv5w
SHA256 8739a25945f9bcce6b50686a10ecca834aa2b201e724a5ebc79ef815b3db915b
MD5 d99d2aad102f1ca928f9e4527da29a0c
SHA1 2f3af9844ec66068de5db49d7fcf9973457db6cd
SHA512 02d4260e9c60dc9abff309175b9696c0b873bf33fff67dfb5187a4414608857fef5e8e03164a0cdd0ae480d9bf900c5d62950ec008545c35caf98402e8f8d020
SSDEEP 6144:dUfhZGlnDtX7qXwUO7ehS4XZTw91hrheU8sdxBTqaAIYX/JoD:dyK5BrqtO7wXIUJo
TLSH
T1AE643A53E28501F8E86AE139D34AE225FA727C9003D1F4CF13605735BE66AE4AE3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateTaskMachineCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Loader.exe"	Loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdateTaskMachineCore = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Loader.exe"	Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
620	Loader.exe
4528	Loader.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Loader.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Cache7821.dat:rec	Loader.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Cache7821.dat:rec	Loader.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- NTFS ADS
PID:620

C:\Users\Admin\AppData\Local\Temp\Loader.exe
C:\Users\Admin\AppData\Local\Temp\Loader.exe
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- NTFS ADS
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cache7821.dat:rec

Path C:\Users\Admin\AppData\Local\Temp\Cache7821.dat:rec
Size 328KB
SHA256 8739a25945f9bcce6b50686a10ecca834aa2b201e724a5ebc79ef815b3db915b
MD5 d99d2aad102f1ca928f9e4527da29a0c
SHA1 2f3af9844ec66068de5db49d7fcf9973457db6cd
SHA512 02d4260e9c60dc9abff309175b9696c0b873bf33fff67dfb5187a4414608857fef5e8e03164a0cdd0ae480d9bf900c5d62950ec008545c35caf98402e8f8d020
SSDEEP 6144:dUfhZGlnDtX7qXwUO7ehS4XZTw91hrheU8sdxBTqaAIYX/JoD:dyK5BrqtO7wXIUJo
TLSH
T1AE643A53E28501F8E86AE139D34AE225FA727C9003D1F4CF13605735BE66AE4AE3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbg.log

Path C:\Users\Public\dbg.log
Size 982B
SHA256 4333f2a5e436195ff699ba0aa021c1ecc870310b3bf82a1998fea80b30a35d73
MD5 d902289035456158852f78419c06bf95
SHA1 db59b48042f74998fd9e21c458777d96e505d64b
SHA512 f134022b384e2a05d6524ba82469330c49ad58330b78de57790f2be83d219055082b7e7fce7d579055802f7f2178153ca3a20a9c3c15801ef7e310b6969afb59
TLSH
T1F211F36AA7E50918F8F36B9AE9B48061AF70BC91283DC21C01D1004EC8F2FC4F9613B7
MD5 SHA1 SHA512 TLSH

Submit Download

dbg.log

Path C:\Users\Public\dbg.log
Size 1KB
SHA256 9e9adccf02306873efe571676f7f6be792a44f0fb539891b43b5c3e2747fa9ea
MD5 592a7b418b6c9f7773801bd4b905d300
SHA1 f122bba5c63d2ed4aa77a93775b1f20d179a14dc
SHA512 faef90e54e6d60965a6ce2339708fd851dfa27321b993d18d7e2b2655eeba90aee35ffdaf4b249594a6a7487e64f7b6212057d7360b90a1cac578602b4b6d0d6
TLSH
T1A921E76AA7E51518F8F36B95E9B48061AF71BC91583DC21C01D5014E98F2FC4F9613B3
MD5 SHA1 SHA512 TLSH

Submit Download

dbg.log

Path C:\Users\Public\dbg.log
Size 658B
SHA256 14e17cb27acafc370bed1e3ba7822e199e8390143bfdffc688edefe9fd26e17e
MD5 35d7854aa82a4ad22534859d3498f73e
SHA1 e5acdb139a512ccec22fa64ecdfca07a5a6a870b
SHA512 34325ed7152e6709039b6f5bacb1d3eaed22cfad0fa3e233491a37f9f06d6368bdc031075253f3e66f6a243abcb8e29fbd1d9920d5afb32e8faffa591f5ca2f3
TLSH
T15E01E76AA7E51518F8F36B95E9B48061AF71BC91583DC21C0195014E98F2FC4F9603B3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads