ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious processes execute known “Unknown Loader” indicators of compromise to establish persistence or deliver payloads within the Azure environment. Proactive hunting is critical because these specific IOCs often represent early-stage infection vectors that automated alerts may miss until lateral movement occurs, allowing the SOC team to contain threats before they escalate into full-blown incidents.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 31 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
domain	allencourtpharmacy.ca	payload_delivery	2026-07-01	50%
url	hxxps://merabs.pro/234097cf.exe	payload_delivery	2026-07-01	100%
domain	alwadannews24.com	payload_delivery	2026-07-01	50%
domain	atrafen.com	payload_delivery	2026-07-01	50%
domain	bleuhaven.com	payload_delivery	2026-07-01	50%
domain	cashforcars-pittsburgh.com	payload_delivery	2026-07-01	50%
domain	countryadumim.com	payload_delivery	2026-07-01	50%
domain	dirtbgone.ie	payload_delivery	2026-07-01	50%
domain	hubble-termite.com	payload_delivery	2026-07-01	50%
domain	ikinogo.net	payload_delivery	2026-07-01	50%
domain	prolotherapydenver.com	payload_delivery	2026-07-01	50%
domain	sunpermit.com	payload_delivery	2026-07-01	50%
domain	vanman.nz	payload_delivery	2026-07-01	50%
domain	www.amazonia-navigators.ro	payload_delivery	2026-07-01	50%
domain	www.tuttoinriviera.com	payload_delivery	2026-07-01	50%
url	hxxps://merabs.pro/fef5dad8.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/4763f422.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/f55c88c3.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/e95bb15f.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/0f186364.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/5f2f9b06.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/33fc733a.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/a4ab25da.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/62706817.exe	payload_delivery	2026-07-01	100%
url	hxxps://merabs.pro/3c199c55.exe	payload_delivery	2026-07-01	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["allencourtpharmacy.ca", "alwadannews24.com", "atrafen.com", "bleuhaven.com", "cashforcars-pittsburgh.com", "countryadumim.com", "dirtbgone.ie", "hubble-termite.com", "ikinogo.net", "prolotherapydenver.com", "sunpermit.com", "vanman.nz", "www.amazonia-navigators.ro", "www.tuttoinriviera.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["https://merabs.pro/234097cf.exe", "https://merabs.pro/fef5dad8.exe", "https://merabs.pro/4763f422.exe", "https://merabs.pro/f55c88c3.exe", "https://merabs.pro/e95bb15f.exe", "https://merabs.pro/0f186364.exe", "https://merabs.pro/5f2f9b06.exe", "https://merabs.pro/33fc733a.exe", "https://merabs.pro/a4ab25da.exe", "https://merabs.pro/62706817.exe", "https://merabs.pro/3c199c55.exe", "https://merabs.pro/6a94e8ad.exe", "https://merabs.pro/8dd99b31.exe", "https://merabs.pro/c8787734.exe", "https://merabs.pro/3b006736.exe", "https://merabs.pro/703520a5.exe", "https://merabs.pro/fb5fff92.exe"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown Loader IOCs rule, tailored for an enterprise environment where legitimate software deployment and maintenance often mimic loader behavior:

• Enterprise Software Deployment via SCCM/Intune

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Intune agent executes a silent installation package for a critical application (e.g., Adobe Acrobat Reader or Zoom). During the extraction phase, the deployment engine (ccmexec.exe or Microsoft.Windows.Search) spawns temporary loader processes that match the “Unknown Loader” IOCs while unpacking compressed binaries to %TEMP%.
  • Filter/Exclusion: Exclude process paths containing C:\Windows\CCM\, C:\Program Files (x86)\Intune Management Extension\, or parent processes named ccmexec.exe and Microsoft.Windows.Search.exe.

• Scheduled Antivirus Definition Updates

  • Scenario: The scheduled daily task for endpoint protection software (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) triggers an update. The vendor’s updater service downloads a new signature database archive and utilizes a proprietary loader utility to extract and register the new definitions before restarting the core engine, generating IOCs identical to the Unknown Loader profile.
  • Filter/Exclusion: Create a rule exclusion for processes initiated by Task Scheduler (taskschd.exe) with command lines containing vendor-specific keywords (e.g., falconupdater, S1Agent, or MpCmdRun.exe) and file paths under the specific vendor installation directory (e.g., C:\Program Files\CrowdStrike\).

• Java Runtime Environment (JRE) Auto-Updates

  • Scenario: The Java Update Scheduler (jusched.exe) runs in the background to patch the JRE. This process invokes a temporary