MintsLoader Multi-Stage Loader

What happened: Red Canary ranked MintsLoader ninth in its 2026 Threat Detection Report, based on activity affecting about two percent of its customers during 2025, and described continued use across KongTuke paste-and-run lures, SocGholish fake updates, and invoice-themed JavaScript delivery. Recorded Future independently documented the same loader family across multiple traffic-distribution and phishing paths, while Blackpoint Cyber reported a 2026 variant that changed its PowerShell obfuscation but retained core retrieval behavior. The family is a loader, not a single intrusion actor: a detection does not by itself attribute KongTuke, SocGholish, TAG-124, or any downstream payload.

How the loader works: the user launches JavaScript or pastes a command, Windows Script Host or an interactive shell starts hidden PowerShell, and the stage retrieves content from a request shaped as /1.php?s= before immediately executing it. Later PowerShell is encoded or compressed, attempts AMSI impairment, and checks video-controller, cache-memory, computer-system, and virtualization characteristics. The environment result and host identity help a server choose between a payload and a decoy. Documented variants use generated .top infrastructure, dynamically assembled destination values, and temporary .ps1 staging under Public Documents or AppData. Downstream payloads have included stealers and remote-access malware, but the payload mix changes by delivery cluster.

Why detection belongs in process lineage: Q01 combines hidden PowerShell, remote retrieval, immediate execution, and the durable request shape, making it more resilient than a hostname, hash, or filename. Q02 follows JavaScript-to-PowerShell lineage; Q03 exposes encoded or compressed PowerShell with AMSI-related tokens; Q04 tracks environment checks; Q05 hunts process-associated generated-domain lookups; and Q06 looks for user-writable script staging. Literal infrastructure rotates, script strings change between builds, and the current sources did not support a fresh, independently corroborated atomic IOC set. DNS context can also be broken by resolver, proxy, IPv6, or field-mapping differences.

Operational consequence: this pack is strongest as a behavior-led endpoint hunt paired with PowerShell Operational logs and approved proxy or web telemetry. Process command lines cannot prove the complete HTTP path, portable Falcon deletion semantics are not assumed, and script-block content exists only where Windows logging is enabled and securely collected. Q01 has a complete design-only alert package, but no query was parsed in a Falcon tenant, no benign baseline or positive fixture was run, no schedule was created, and no prevention control was enabled.

Seven current-run snapshots retain sanitized plain-text evidence only. All webpage text and indicator strings were treated as untrusted data; no source-supplied command, code, payload, destination, or instruction was executed.

Claim ledger

The chain follows initial user execution into staged PowerShell, defense evasion, environment checks, rotating infrastructure, and temporary script staging. Each hypothesis remains traceable to claims and a validation plan.

Hypotheses

Affected surface and telemetry

Relevant surfaces are Windows endpoints where users can launch JavaScript, PowerShell, or pasted commands and where outbound web access is available. Portable coverage assumes Falcon process and DNS events with the named fields. Full URL paths need proxy or EDR web telemetry; deobfuscated script content needs protected PowerShell logging; file cleanup needs tenant-specific event semantics; DNS process attribution needs local verification.

Coverage boundaries

• HTTP request-path matching for /1.php?s= requires proxy, web, or EDR URL telemetry with known fields; process command lines are only a partial view.
• PowerShell script-block and deobfuscated-content fields are not assumed without tenant-specific ingestion.
• Portable Falcon deletion-event semantics are not documented for this build, so rapid cleanup remains a forensic correlation step.
• IPv6, proxy, and DNS resolver indirection can break endpoint-to-domain attribution.
• Loader detection does not attribute activity to KongTuke, SocGholish, TAG-124, or any payload family.

No atomic IP addresses, domains, URLs, or hashes were published by the accessible current sources with sufficient freshness and independent corroboration for inclusion as of 2026-09-05. Historical infrastructure was deliberately excluded.

Every ATT&CK row is an analyst inference from source-backed behavior; it is not a vendor attribution statement.

All six queries are STATIC-ONLY. Confirm repository, event population, fields, semantics, and result volume in a safe manual window before operational use.

// HUNT: Hidden PowerShell staged retrieval and execution
// HYPOTHESIS: H01
// USE: alert-candidate
// MITRE: T1059.001, T1105
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — capture low-frequency loader execution
// REQUIRES: #event_simpleName=ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: software bootstrap scripts, configuration management, and developer tooling
// TUNING: exclude approved management parents only after confirming signer, path, and owner
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /(?:powershell|pwsh)\.exe$/i
| CommandLine = /(?:-w(?:indowstyle)?\s+h(?:idden)?|windowstyle\s+hidden)/i
| CommandLine = /(?:curl|invoke-webrequest|iwr|invoke-restmethod|irm)/i
| CommandLine = /(?:\|\s*(?:iex|invoke-expression)|;\s*(?:iex|invoke-expression)|\.(?:content|exportedcommands))/i
| CommandLine = /\/1\.php\?s=/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Windows Script Host spawning PowerShell retrieval
// HYPOTHESIS: H02
// USE: hunt
// MITRE: T1059.007, T1059.001
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — catch intermittent lure execution
// REQUIRES: #event_simpleName=ProcessRollup2 or SyntheticProcessRollup2; ParentBaseFileName, ImageFileName, CommandLine
// FALSE POSITIVES: legacy login scripts and enterprise software deployment
// TUNING: exclude signed, owner-approved script packages and known deployment parents
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 2592000000)
| ParentBaseFileName = /^(wscript|cscript)\.exe$/i
| ImageFileName = /(?:powershell|pwsh)\.exe$/i
| CommandLine = /(?:curl|invoke-webrequest|iwr|invoke-restmethod|irm|downloadstring|downloadfile|iex|invoke-expression)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Obfuscated PowerShell with AMSI-related tokens
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1027, T1562.001
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 14d — bound a broad obfuscation search
// REQUIRES: #event_simpleName=ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: security testing and administrative packaging scripts
// TUNING: exclude approved red-team windows and signed packaging workflows after review
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 1209600000)
| ImageFileName = /(?:powershell|pwsh)\.exe$/i
| CommandLine = /(?:-e(?:nc|ncodedcommand)?\s+|frombase64string|gzipstream|deflatestream)/i
| CommandLine = /(?:amsi|amsiutils|amsiinitfailed|invoke-expression|\biex\b)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: PowerShell and WMI virtualization discovery
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1497.001
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 14d — correlate recent system checks with loader signals
// REQUIRES: #event_simpleName=ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: asset inventory, support diagnostics, and virtualization management
// TUNING: exclude known management agents and documented inventory scripts
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 1209600000)
| ImageFileName = /(?:powershell|pwsh|wmic)\.exe$/i
| CommandLine = /(?:Win32_VideoController|Win32_CacheMemory|Win32_ComputerSystem|hypervisor|virtualbox|vmware)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: PowerShell-associated generated .top lookups
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1105
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 7d — bound high-volume DNS and volatile infrastructure
// REQUIRES: #event_simpleName=DnsRequest; DomainName, ContextBaseFileName, ContextProcessId_decimal
// FALSE POSITIVES: security research, advertising redirects, and software update services
// TUNING: baseline .top domains and verify process attribution before excluding any resolver path
// VALIDATION: STATIC-ONLY
#event_simpleName = DnsRequest
| test(@timestamp >= now() - 604800000)
| ContextBaseFileName = /^(powershell|pwsh)\.exe$/i
| DomainName = /^[a-z0-9]{12,24}\.top$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, ContextProcessId_decimal, DomainName, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: User-writable PowerShell script staging
// HYPOTHESIS: H06
// USE: hunt
// MITRE: T1105
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — retain low-frequency user-path staging
// REQUIRES: #event_simpleName=ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: user automation, software installers, and IT support scripts
// TUNING: exclude owner-approved scripts by full path and signer only after review
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /(?:powershell|pwsh)\.exe$/i
| CommandLine = /(?:\\Users\\Public\\Documents|\\Users\\[^\\]+\\AppData\\)[^"']*\.ps1/i
| CommandLine = /(?:-w(?:indowstyle)?\s+h(?:idden)?|-executionpolicy\s+bypass|-noprofile)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Q01 has a complete design-only scheduled-search package. Q02–Q06 remain hunt-only. No Falcon schedule, notification route, IOA, prevention policy, or deployment was created.

Design-only scheduled search

No atomic IP addresses, domains, URLs, or hashes were published by the accessible current sources with sufficient freshness and independent corroboration for inclusion as of 2026-09-05. Historical infrastructure was deliberately excluded.

type,value,source,action
# No eligible atomic IOCs as of 2026-09-05

hidden PowerShell + remote retrieval + immediate execution
Windows Script Host → PowerShell lineage
encoded/compressed PowerShell + AMSI-related tokens
PowerShell-associated generated .top lookup
user-writable .ps1 staging

Historical domains and addresses were excluded because infrastructure rotates and current independent corroboration was absent. Do not manufacture, contact, or block values from stale reporting.

Deployable playbook · PB01 · Pilot MintsLoader-focused ASR rules

1. Confirm Defender, AMSI, and cloud-protection prerequisites; export the current policy and endpoint membership.
2. Capture pre-change Get-MpPreference rule IDs/actions and the last 14 days of relevant ASR events.
3. Apply both rule GUIDs in Audit mode to the limited pilot through the approved management channel.
4. Verify policy convergence and collect audit evidence from an inert approved script fixture.
5. Run application-owner and help-desk health checks for installers, packaging, and signed business scripts.
6. Expand only when every event family is owned, critical workflows pass, and exclusions are narrow and approved.
7. If a stop condition fires, restore the exported policy or set the affected rule Disabled; verify convergence and application recovery.
8. Retain policy exports, event samples, exception decisions, owner approvals, and the rollback result under endpoint security ownership.

Deployable playbook · PB02 · Deploy protected PowerShell script-block logging

1. Approve sensitive-data handling, restricted reader roles, retention, and storage capacity.
2. Export the current PowerShell logging GPO or MDM state and forwarding configuration.
3. Enable Script Block Logging for the pilot and route Event ID 4104 to restricted storage.
4. Execute an inert local marker and verify one complete 4104 record with host and user context.
5. Review endpoint performance, ingestion volume, secret exposure risk, and analyst access.
6. Expand only when volume and access controls meet the approved thresholds.
7. Rollback by disabling the pilot policy and forwarding rule; verify no new marker collection while preserving prior evidence.
8. Retain configuration exports, marker event, access review, storage metrics, and rollback evidence under Windows platform ownership.

Preservation order: raw query and alert rows; process tree and command lines; PowerShell logs; files and hashes; proxy, DNS, and network records; user and session state; relevant policy configurations; analyst notes and tool logs.

Closure gates: malicious scripts and payloads removed or endpoint rebuilt; credentials or sessions addressed when exposure is evidenced; temporary containment changes reviewed; Q01-Q06 re-run after recovery with no unexplained hits; business owner and incident commander approve closure. Re-hunt: Run Q01-Q06 immediately after recovery, again after 24 hours, and at seven days; retain raw results and explain every hit.

Validation state: STATIC REVIEW PASSED after local structural/safety, maintained-field, CQL heuristic, provenance, and duplicate gates. Provenance is N/A because the report deliberately ships no atomic IOCs. This is not Falcon parsing, canary success, schedule creation, or deployment evidence.

Recorded evidence and next tests

• All six CQL cards retain VALIDATION: STATIC-ONLY; no Falcon tenant was contacted.
• The offline tenant-validation dry run checks extraction and profile readiness only.
• Q05 depends on tenant-confirmed DNS process attribution; URL-path and deletion evidence require separate repositories.
• A01 remains design-only with unknown baseline and planned-not-run positive and benign tests.
• Next step: manually parse Q01 in the intended repository over one hour, confirm every returned field, then run the approved inert fixture and 30-day benign baseline before scheduling.