Overview

overview

6

Static

static

3

Loader (3).exe

windows10-ltsc_2021-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    84s
  • max time network
    63s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    16/10/2026, 23:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Loader (3).exe
  • Size 392KB
  • Sample261016-3lencses6m
  • SHA256 c255a378e9e627a2d14c8af0a263c0e3d4cf335c5004c8f398608707f7976c90
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader (3).exe
    "C:\Users\Admin\AppData\Local\Temp\Loader (3).exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    PID:5988
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3792
    • C:\Users\Admin\AppData\Local\Temp\Loader (3).exe
      "C:\Users\Admin\AppData\Local\Temp\Loader (3).exe"
      1⤵
      • Reads the TCP/IP host and domain name from the registry
      PID:5384
    • C:\Users\Admin\AppData\Local\Temp\Loader (3).exe
      "C:\Users\Admin\AppData\Local\Temp\Loader (3).exe"
      1⤵
      • Reads the TCP/IP host and domain name from the registry
      PID:4024

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          7C9C685DB131C6A44501919A1618D8CC
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7C9C685DB131C6A44501919A1618D8CC
          • Size 309B
          • SHA256 8a522f2691024adf1f01a17340eb8163c59caae7eb97f8f0ce08ab983f6c4199
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Size 1KB
          • SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B46811C17859FFB409CF0E904A4AA8F8
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
          • Size 529B
          • SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7C9C685DB131C6A44501919A1618D8CC
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7C9C685DB131C6A44501919A1618D8CC
          • Size 192B
          • SHA256 eb86da2a312d03b2f32fca3c87a5dec2b6110b49cdd7670fb51b7153483e8d73
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Size 174B
          • SHA256 f46d39d83c78c896a024c147a55f8710f5278a6cf65d543cab0707b88a9d927b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B46811C17859FFB409CF0E904A4AA8F8
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
          • Size 170B
          • SHA256 955c09d1926acbf9e6bfeff2459f28cc184fd30d44c4f2769ad92e88ccffaee8
          • MD5 SHA1 SHA512 TLSH
          Submit Download