Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 01:11
General
- Target mrjohn.loader.exe
- Size 11.1MB
- Sample261113-bj59rayv2n
- SHA256 9300e66577733b19ee7838b1806629632eef3a71f1150d6bc2ab0519aeebb872
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mrjohn.loader.exe"C:\Users\Admin\AppData\Local\Temp\mrjohn.loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
splatvik_loader_debug.log
memory/1580-30-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-41-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-18-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-24-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-28-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-3-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-36-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-13-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-45-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-48-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-8-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-53-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-58-0x00007FF695190000-0x00007FF695CB5000-memory.dmp
memory/1580-64-0x00007FF695190000-0x00007FF695CB5000-memory.dmp