Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader-free.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader-free.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target loader-free.exe
- Size 1.9MB
- Sample261102-jsq57aav2r
- SHA256 0a9bbae6e815a0ba4e6aa7ac0abc7dda3e1336d0f4dfd3385b17655a954ee27c
- MD5 6d2159363092caf84d9e1b44ccd7b3af
- SHA1 c7e471454d22fe91fb6e3b9797cb452046c16a77
- SHA512 c062177f9bb20f25a8faf06618e5a6c56e04c667ecb86a2f4175bd1acb5beddb16b7056015729e0fddbd11a4c98ca86fed2cbcfa65649d5f7d02d558ec50208e
- SSDEEP 49152:9jIi0bfLK4K8zVW3HknQKt9lHOI8GZL7BMzlvnyyQtO88nUlj4CT:9ITu4DzNlHOI8GZL7BMRnkMCT
- TLSH T11295AE59B3A801E8E1B7D278C5465607EBB2744C17315ADB03D08BA92F237E16B3F768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
pid Process 716 loader-free.exe 716 loader-free.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 loader-free.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname loader-free.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain loader-free.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe 716 loader-free.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 716 loader-free.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 716 loader-free.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader-free.exe"C:\Users\Admin\AppData\Local\Temp\loader-free.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:716