Resubmissions
07/11/2026, 22:47
261107-2qphpast7r1029/10/2026, 21:28
261029-1bm6mse12w1024/10/2026, 16:56
261024-vf2xpszz9n1006/09/2026, 20:07
260906-yv2r2agj3w10Analysis
- max time kernel
140s - max time network
277s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 22:47
General
- Target taskmanager.exe
- Size 166KB
- Sample261107-2qphpast7r
- SHA256 28e985edba59127261da83fe963b0a3674d9007840acd8db505fec6ac455c987
Malware Config
Extracted
-
2cloader
-
b2b7404d54df46c22815c972c5cd15c8
-
https://aware-cr1.com/api/beacon
-
build_time
2026-11-06T10:30:05Z
-
inject_target
dllhost.exe
-
options
ppid_spoof
-
payload_name
build_sbuild.exe
Signatures
- Family: 2CLoader
2CLoader is a Windows loader written in C++ that delivers stealers such as Vidar and Remus.
- Downloads MZ/PE file 2 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\taskmanager.exe"C:\Users\Admin\AppData\Local\Temp\taskmanager.exe"1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13921240101\gdtrupoqncyropd22.exe"C:\Users\Admin\AppData\Local\Temp\13921240101\gdtrupoqncyropd22.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-83WADXF96P.tmp\gdtrupoqncyropd22.tmp"C:\Users\Admin\AppData\Local\Temp\is-83WADXF96P.tmp\gdtrupoqncyropd22.tmp" /SL5="$600A6,2647927,873984,C:\Users\Admin\AppData\Local\Temp\13921240101\gdtrupoqncyropd22.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\13921250101\v848f.exe"C:\Users\Admin\AppData\Local\Temp\13921250101\v848f.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5BCBF8.xml" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5BCB65.xml" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\13921250101\v848f.exeC:\Users\Admin\AppData\Local\Temp\13921250101\v848f.exe1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5BC488.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5BC45F.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
gdtrupoqncyropd22.exe
v848f.exe
gdtrupoqncyropd22.tmp
_isdecmp.dll
~st0E5BC45F.xml
~st0E5BCB65.xml
~st0E5BCBF8.xml
memory/252-27-0x0000000000910000-0x00000000009F4000-memory.dmp
memory/252-100-0x0000000000910000-0x00000000009F4000-memory.dmp
memory/252-79-0x0000000000910000-0x00000000009F4000-memory.dmp
memory/4064-59-0x000000014E640000-0x000000014E840000-memory.dmp
memory/4064-67-0x000000014E640000-0x000000014E840000-memory.dmp
memory/4064-66-0x000000014E640000-0x000000014E840000-memory.dmp
memory/4828-99-0x0000000000610000-0x0000000000A52000-memory.dmp
memory/4828-83-0x0000000001400000-0x0000000001401000-memory.dmp
memory/4828-82-0x0000000000610000-0x0000000000A52000-memory.dmp
memory/4828-86-0x0000000000610000-0x0000000000A52000-memory.dmp
memory/4828-35-0x0000000001400000-0x0000000001401000-memory.dmp
memory/5332-80-0x000000014E640000-0x000000014E840000-memory.dmp
memory/5332-78-0x000000014E640000-0x000000014E840000-memory.dmp
memory/5380-5-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-1-0x0000000001024000-0x0000000001025000-memory.dmp
memory/5380-2-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-81-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-0-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-8-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-6-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-7-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-31-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-102-0x0000000000FB0000-0x0000000001025000-memory.dmp
memory/5380-103-0x0000000000FB0000-0x0000000001025000-memory.dmp