a414ef0e41811a92bb5be4237136422c1ae38491e60a53abfc44a1426e45e497

Analysis

max time kernel
150s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 59.9MB
Sample261107-vbss8szwcs
SHA256 a414ef0e41811a92bb5be4237136422c1ae38491e60a53abfc44a1426e45e497
MD5 8596494530ceb24e6802a473481a0b82
SHA1 86afe86d02d168b684e7f6768a43a8abeeb6c9a9
SHA512 6286b9271be3651603cd310e44ac9930b94ba7c66bd11bdc6d747f1cd1cbc30ccb2fca613f2277ef10c046c1e349009cf5d381075afd7fad25693f62f869f7e1
SSDEEP 393216:jlg++eKUYae2OcJs+6LXp6pB65++K0m40jUmkI9mnmSZnwfTrnCFRy+o33irYVI2:jVgCJrhTQRACrYVKAGRjqt
TLSH
T106D7494666EA0481FDF7EA3489F65513C673BC166F3185CF220C1B2A1F776E0897A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
4056	powershell.exe
3268	powershell.exe
4656	powershell.exe
908	powershell.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2788	tasklist.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3672	cmd.exe
4392	cmd.exe
1424	cmd.exe
5024	cmd.exe
5480	cmd.exe
3448	cmd.exe
3488	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Loader.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4040	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4656	powershell.exe
4656	powershell.exe
908	powershell.exe
908	powershell.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
4056	powershell.exe
4056	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe
Token: 34	4656	powershell.exe
Token: 35	4656	powershell.exe
Token: 36	4656	powershell.exe
Token: SeDebugPrivilege	2788	tasklist.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeIncreaseQuotaPrivilege	908	powershell.exe
Token: SeSecurityPrivilege	908	powershell.exe
Token: SeTakeOwnershipPrivilege	908	powershell.exe
Token: SeLoadDriverPrivilege	908	powershell.exe
Token: SeSystemProfilePrivilege	908	powershell.exe
Token: SeSystemtimePrivilege	908	powershell.exe
Token: SeProfSingleProcessPrivilege	908	powershell.exe
Token: SeIncBasePriorityPrivilege	908	powershell.exe
Token: SeCreatePagefilePrivilege	908	powershell.exe
Token: SeBackupPrivilege	908	powershell.exe
Token: SeRestorePrivilege	908	powershell.exe
Token: SeShutdownPrivilege	908	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeSystemEnvironmentPrivilege	908	powershell.exe
Token: SeRemoteShutdownPrivilege	908	powershell.exe
Token: SeUndockPrivilege	908	powershell.exe
Token: SeManageVolumePrivilege	908	powershell.exe
Token: 33	908	powershell.exe
Token: 34	908	powershell.exe
Token: 35	908	powershell.exe
Token: 36	908	powershell.exe
Token: SeDebugPrivilege	4040	taskkill.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe
Token: SeTakeOwnershipPrivilege	4056	powershell.exe
Token: SeLoadDriverPrivilege	4056	powershell.exe
Token: SeSystemProfilePrivilege	4056	powershell.exe
Token: SeSystemtimePrivilege	4056	powershell.exe
Token: SeProfSingleProcessPrivilege	4056	powershell.exe
Token: SeIncBasePriorityPrivilege	4056	powershell.exe
Token: SeCreatePagefilePrivilege	4056	powershell.exe
Token: SeBackupPrivilege	4056	powershell.exe
Token: SeRestorePrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeSystemEnvironmentPrivilege	4056	powershell.exe
Token: SeRemoteShutdownPrivilege	4056	powershell.exe
Token: SeUndockPrivilege	4056	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4392	4732	Loader.exe	88
PID 4392 wrote to memory of 4656	4392	cmd.exe	90
PID 4732 wrote to memory of 1424	4732	Loader.exe	92
PID 1424 wrote to memory of 2788	1424	cmd.exe	94
PID 4732 wrote to memory of 5024	4732	Loader.exe	95
PID 5024 wrote to memory of 908	5024	cmd.exe	97
PID 4732 wrote to memory of 5480	4732	Loader.exe	98
PID 5480 wrote to memory of 4740	5480	cmd.exe	100
PID 4740 wrote to memory of 1252	4740	net.exe	101
PID 4732 wrote to memory of 3448	4732	Loader.exe	102
PID 3448 wrote to memory of 4040	3448	cmd.exe	104
PID 4732 wrote to memory of 3488	4732	Loader.exe	105
PID 3488 wrote to memory of 3268	3488	cmd.exe	107
PID 4732 wrote to memory of 3672	4732	Loader.exe	109
PID 3672 wrote to memory of 4056	3672	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b1ca9d682ae782b28102c453c46a35902822c4c55d3a944c05d91f8092ea29d2
MD5 a611bd4d14672caf36dc23a45de32229
SHA1 bded478fec54f00772deb55b3631875b6dd0fc7e
SHA512 0e13287c18a8eaa0963f620d78fc6e86dcfa8b7244ddb15cac44d7b705617db5baa6f6c8e68d24a46923ab0a46ffe880ed7cbdc13ae9c7e55c7dbc1536e0c484
TLSH
T170219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3b4bbd46cee330a216e4083ddaad37fc87a34c1a075c296bae53135c55f40c84
MD5 36216f95bf777b63548a07eba89d7dce
SHA1 d47cae153dc05d6fadb52f1b1c9d3bab4b149229
SHA512 b09e63ad410c6e6c073dfe6f1891be73db64c5753374a7907544727ac665eb886042e911ef8fdb769ea72ccb5e6706a82c0fcca4af0a0f6b7c440943bbd4281d
TLSH
T1DD215433B3CC8624C89A413A54CEAC0036B687DB819EDFABBB84D544B43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uxjvamks.yjm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uxjvamks.yjm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4656-13-0x00000210F64A0000-0x00000210F64BE000-memory.dmp

Download

memory/4656-15-0x00000210F6580000-0x00000210F658A000-memory.dmp

Download

memory/4656-9-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-10-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-1-0x00007FF832A5F000-0x00007FF832A60000-memory.dmp

Download

memory/4656-14-0x00000210F64C0000-0x00000210F6572000-memory.dmp

Download

memory/4656-7-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-8-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-17-0x00000210F6A30000-0x00000210F6A54000-memory.dmp

Download

memory/4656-16-0x00000210F6A30000-0x00000210F6A5A000-memory.dmp

Download

memory/4656-19-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-20-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-6-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-4-0x00007FF8328D0000-0x00007FF833274000-memory.dmp

Download

memory/4656-5-0x00000210F63F0000-0x00000210F6412000-memory.dmp

Download