SharkLoader LdrLoaderLock Bypass: Suspicious SystemSettings.exe Thread Injection

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.