The use of digital infrastructures has increased cyber risks, with malware loaders becoming key routes for discreet payload distribution and proliferation. The growth of obfuscation techniques makes conventional detection methods difficult, stressing the necessity for more advanced procedures. A novel system that combines Large Language Models (LLMs) with Retrieval-Augmented Generation (RAG) improves Windows Malware Loader analysis. The framework analyzes API call sequences to identify key behavioral patterns (Injection, Persistence, and Command and Control (C2) Connections) and aligns them with the MITRE ATT&CK framework to comprehend attack methods. LLMs also automate YARA rule development, enhancing detection efficiency and adaptability while eliminating signature limitations. LLM hallucinations are reduced by RAG, enhancing detection reliability. Additionally, an Ontology-based model visualizes malware activities in a systematic manner, improving threat intelligence. Experimental results show the framework can examine complicated malware variants, demonstrating its potential to improve cybersecurity.