This hunt targets the presence of 49 known indicators of compromise associated with the Unknown Loader, a tool frequently used by adversaries to establish initial footholds and execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel is critical to detect and contain stealthy loader activity before it progresses to lateral movement or data exfiltration.
Malware Family: Unknown Loader Total IOCs: 49 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | foldstation.cfd | botnet_cc | 2026-09-08 | 100% |
| domain | fleshproduce.xyz | botnet_cc | 2026-09-08 | 100% |
| domain | goldenseatnwa.com | payload_delivery | 2026-09-08 | 75% |
| domain | yubairwmp.org | payload_delivery | 2026-09-08 | 100% |
| domain | yumandquick.com | payload_delivery | 2026-09-08 | 100% |
| domain | zargreen.com | payload_delivery | 2026-09-08 | 100% |
| domain | zariwarkhabar.com | payload_delivery | 2026-09-08 | 100% |
| domain | zentechonline.com | payload_delivery | 2026-09-08 | 100% |
| domain | zipnorthshore.com | payload_delivery | 2026-09-08 | 100% |
| domain | zmilenow.de | payload_delivery | 2026-09-08 | 100% |
| domain | zub-bonn.de | payload_delivery | 2026-09-08 | 100% |
| domain | worldofroofing.co.uk | payload_delivery | 2026-09-08 | 100% |
| domain | wrongwaylizzie.me | payload_delivery | 2026-09-08 | 100% |
| domain | wtzszumowo.pl | payload_delivery | 2026-09-08 | 100% |
| domain | wusongui.com | payload_delivery | 2026-09-08 | 100% |
| domain | wypozycz-skuter.pl | payload_delivery | 2026-09-08 | 100% |
| domain | xcat.nl | payload_delivery | 2026-09-08 | 100% |
| domain | xn--iac-dren-b6a.de | payload_delivery | 2026-09-08 | 100% |
| domain | xn--lrer-voa.dk | payload_delivery | 2026-09-08 | 100% |
| domain | yannick-golz.de | payload_delivery | 2026-09-08 | 100% |
| domain | yomeammo.com | payload_delivery | 2026-09-08 | 100% |
| domain | withron.com | payload_delivery | 2026-09-08 | 100% |
| domain | witool.org | payload_delivery | 2026-09-08 | 100% |
| domain | wnailloungeandhairspa.com | payload_delivery | 2026-09-08 | 100% |
| domain | workershealth.eu | payload_delivery | 2026-09-08 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["foldstation.cfd", "fleshproduce.xyz", "goldenseatnwa.com", "yubairwmp.org", "yumandquick.com", "zargreen.com", "zariwarkhabar.com", "zentechonline.com", "zipnorthshore.com", "zmilenow.de", "zub-bonn.de", "worldofroofing.co.uk", "wrongwaylizzie.me", "wtzszumowo.pl", "wusongui.com", "wypozycz-skuter.pl", "xcat.nl", "xn--iac-dren-b6a.de", "xn--lrer-voa.dk", "yannick-golz.de", "yomeammo.com", "withron.com", "witool.org", "wnailloungeandhairspa.com", "workershealth.eu", "web.wp-autotechnik.de", "webcreated.net", "weblan.com.br", "wellmaxinsure.com", "wex.com.pl", "wide-verwaltung.de", "wikidoma.com", "williames.com", "williamtammingaarchitects.com", "winnerads.co.uk", "wiscwomeningovernment.org", "vintagegayrimenkul.com", "visainternationalgroup.com", "visitasguiadasvalladolid.com", "viva883.gr", "voedselbankleiden.nl", "volkanaskun.com", "vuole.pe", "walkthenight.com", "wandelphase.de", "wared.co", "wb5fhi.net", "va.com.pl", "vamosdevinos.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
gpupdate.exe or ccmexec.exe (SCCM client), or whitelist the specific file path (e.g., C:\Program Files\LegacyReport\bin\report.exe) if the hash is stable.C:\Temp\ or C:\Scripts\) to avoid permission issues, triggering the “unknown loader” heuristic due to its location and hash.
svchost.exe (specifically the Task Scheduler service) and the command line contains known keywords like rotate, clean, or archive. Alternatively, whitelist the specific scheduled task name (e.g., DailyLogCleanup).C:\ProgramData\ or C:\Windows\Temp\ to perform a quick integrity check or update its signature database. This binary often has a generic name (e.g., helper.exe, update.bin) that matches known loader IOCs.