bdfe2c93c30835701675e9f5d8df83c94a1b5e42d8ff1e12a72d45325ec1052a

Analysis

user interaction
yes
max time kernel
6s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cs2_loader.exe
Size 402KB
Sample261110-ejj83ayxds
SHA256 bdfe2c93c30835701675e9f5d8df83c94a1b5e42d8ff1e12a72d45325ec1052a
MD5 947beed29c9b7d0807a4960d85760f86
SHA1 29c5a47d5711852724af87c8693b6c247a3a48bb
SHA512 d259ecfeb3c91593e9b7503f0fc1395125baaef7f99cb21116f7c48e037d507c4a888c980c1ec87bb562ed0adde295c8f69f641e73ab45fae0f35fc0fca24ff9
SSDEEP 6144:b3DrIHlV0P4Ie3y3cd2LP7h8sNG8LEVK8RBvVzfJq5:j/ky4Iky3cd21w8LEIaHz
TLSH
T136947E15EAA810FDE1B7D1B9CD578902EB71784A0370AEDF039449A61F176E48E3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4772	cs2_loader.exe
4772	cs2_loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4772	cs2_loader.exe
4772	cs2_loader.exe

C:\Users\Admin\AppData\Local\Temp\cs2_loader.exe
"C:\Users\Admin\AppData\Local\Temp\cs2_loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads