LegionLoader cmd.exe Spawning 7z.exe Payload Extraction Under AppData Roaming

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•9

Detects a suspicious execution chain associated with LegionLoader where msiexec.exe triggers cmd.exe, which subsequently invokes 7-Zip (7z.exe or 7za.exe) to extract payloads into the AppData\Roaming directory. This pattern is characteristic of LegionLoader's staging phase.