StrikeShark SharkLoader DLL Drop into AppData xwreg/xgdf with Subsequent Load

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the creation of files with specific filenames (e.g. SystemSettings.dll, DscCoreR.mui, SyncRes.dat) within anomalous AppData subdirectories 'xwreg' or 'xgdf', followed by the execution of a process from those same directories within a 5-minute window. This behavior is indicative of SharkLoader malware staging its components and initiating execution.