Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RiftLoaderV4 (1).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
RiftLoaderV4 (1).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target RiftLoaderV4 (1).exe
- Size 45.8MB
- Sample261107-slphfsyx2k
- SHA256 e0061d75c9859208de81e0835a6bade6b71125cbf72afc557e54fb28a4deafbb
- MD5 c3482ee3cdb11fd1fbd16cf696888bcc
- SHA1 cd19749bc394c17a4c2f6154fc6e22d2827aea72
- SHA512 bd0bbad189f1baab40ee606ce8dc5d4a87b755fa438d5cf98db8816149c1bac8c89b885a56aa7fb631b4f2b726b3bb3ed5f04c57c7ac0facb110dc38b9dfffec
- SSDEEP 786432:OUxz8ypDkmzWfKMX+zVgD07DM2HKzG755p7o9gMkXL:OUxgypfzWfKHgg8Zg5L7ogn
- TLSH T13CB702D6F89502D4C7438678454F534BA2A1F0A553A852BF36CA44532D32FDA8EFBF22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname RiftLoaderV4 (1).exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain RiftLoaderV4 (1).exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe 3228 RiftLoaderV4 (1).exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3228 RiftLoaderV4 (1).exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3228 RiftLoaderV4 (1).exe