Analysis
- user interaction
yes - max time kernel
143s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/11/2026, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win11-20260911-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target loader.exe
- Size 5.3MB
- Sample261102-dl85jaea37
- SHA256 6ffe4b8060d232eb4a5a62dd9c3719e987a9863153cc460ad919c98d2458c058
- MD5 22b8912acaaae9a44748678b095c5867
- SHA1 a043a11313a3af156815765ba0d631c407f7f1a6
- SHA512 e17b4b0d52d9201d697d42aacd130d3a89d091b02f786f569493d308149f7b894186d9c7297baa5f46b9ef28ec7a0e2963f29c50c6a194403bf25fe19b8115a7
- SSDEEP 98304:YkrRlwLisY4jnIfFDfrmbzRBmPdc+cTna4NpAV8O5Hm+PIjrKQ2VS+XWkIX/2gbH:TrRK3Y8IdfrmbzXi8lOZA/BkmkKegD
- TLSH T1DC4633DA36C726FDE045CBB49501247D71D47FCA45A0CD492F89E922AC67B2EAF3A304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools loader.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion loader.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum loader.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum loader.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs
pid Process 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN loader.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 32 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive20 loader.exe File opened (read-only) \??\PhysicalDrive29 loader.exe File opened (read-only) \??\PhysicalDrive11 loader.exe File opened (read-only) \??\PhysicalDrive22 loader.exe File opened (read-only) \??\PhysicalDrive3 loader.exe File opened (read-only) \??\PhysicalDrive4 loader.exe File opened (read-only) \??\PhysicalDrive6 loader.exe File opened (read-only) \??\PhysicalDrive8 loader.exe File opened (read-only) \??\PhysicalDrive18 loader.exe File opened (read-only) \??\PhysicalDrive19 loader.exe File opened (read-only) \??\PhysicalDrive30 loader.exe File opened (read-only) \??\PhysicalDrive31 loader.exe File opened (read-only) \??\PhysicalDrive5 loader.exe File opened (read-only) \??\PhysicalDrive9 loader.exe File opened (read-only) \??\PhysicalDrive10 loader.exe File opened (read-only) \??\PhysicalDrive12 loader.exe File opened (read-only) \??\PhysicalDrive27 loader.exe File opened (read-only) \??\PhysicalDrive1 loader.exe File opened (read-only) \??\PhysicalDrive7 loader.exe File opened (read-only) \??\PhysicalDrive13 loader.exe File opened (read-only) \??\PhysicalDrive21 loader.exe File opened (read-only) \??\PhysicalDrive0 loader.exe File opened (read-only) \??\PhysicalDrive2 loader.exe File opened (read-only) \??\PhysicalDrive15 loader.exe File opened (read-only) \??\PhysicalDrive23 loader.exe File opened (read-only) \??\PhysicalDrive25 loader.exe File opened (read-only) \??\PhysicalDrive28 loader.exe File opened (read-only) \??\PhysicalDrive17 loader.exe File opened (read-only) \??\PhysicalDrive26 loader.exe File opened (read-only) \??\PhysicalDrive24 loader.exe File opened (read-only) \??\PhysicalDrive14 loader.exe File opened (read-only) \??\PhysicalDrive16 loader.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain loader.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID loader.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe 4128 loader.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4128 loader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4128 loader.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4128 wrote to memory of 952 4128 loader.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SYSTEM32\dsregcmd.exedsregcmd.exe /status2⤵PID:952
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Debugger Evasion
1Direct Volume Access
1Virtualization/Sandbox Evasion
1