23211cc5c51e8a3d1c0c8a99e5d726e232dd54f8dac7ca28ff11abaca76e864c

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
25/10/2025, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer_v510_x64.exe
Size 5.4MB
Sample251025-sb6c8aew2b
SHA256 23211cc5c51e8a3d1c0c8a99e5d726e232dd54f8dac7ca28ff11abaca76e864c
MD5 9c2d1efc5e4ce03725090b18c7aa5df3
SHA1 786e50d0d3d69230dd910f42517da97ddec6e910
SHA512 766e2e30aa1d716cf58cab440f60c82df3f8d1e2a76fb5483540d2044fd934f536304427658c088d3e2bd5636819bfd90c9e79b7c9889a193f402ee7a490174e
SSDEEP 98304:o7Iyl7/tt72UZ+wIAngYvVF8SyngGjgll4NtMqJdJm/e6Ge7fiTIOz4wzoQDICRO:oMylFZ28AAgYdKS4pjgr+S4oiT6wUQDW
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion execution persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer_v510_x64.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2816	powershell.exe
5456	powershell.exe
2220	powershell.exe
5456	powershell.exe
2816	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer_v510_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer_v510_x64.exe

Executes dropped EXE 3 IoCs

pid	Process
4712	InstallModule023871.exe
4640	IsClosed.exe
1080	IsClosed.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/memory/3904-8-0x0000000000400000-0x0000000001142000-memory.dmp	themida
behavioral3/memory/3904-9-0x0000000000400000-0x0000000001142000-memory.dmp	themida
behavioral3/memory/3904-61-0x0000000000400000-0x0000000001142000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer_v510_x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3904	Installer_v510_x64.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4640 set thread context of 2024	4640	IsClosed.exe	94
PID 1080 set thread context of 5880	1080	IsClosed.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5080	schtasks.exe
5492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5456	powershell.exe
5456	powershell.exe
2220	powershell.exe
2220	powershell.exe
4996	powershell.exe
4996	powershell.exe
2816	powershell.exe
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	Installer_v510_x64.exe
Token: SeDebugPrivilege	5456	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	4712	InstallModule023871.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	4640	IsClosed.exe
Token: SeDebugPrivilege	2024	MSBuild.exe
Token: SeDebugPrivilege	1080	IsClosed.exe
Token: SeDebugPrivilege	5880	InstallUtil.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 5456	3904	Installer_v510_x64.exe	78
PID 3904 wrote to memory of 5456	3904	Installer_v510_x64.exe	78
PID 3904 wrote to memory of 2220	3904	Installer_v510_x64.exe	80
PID 3904 wrote to memory of 2220	3904	Installer_v510_x64.exe	80
PID 2220 wrote to memory of 4712	2220	powershell.exe	82
PID 2220 wrote to memory of 4712	2220	powershell.exe	82
PID 4712 wrote to memory of 5080	4712	InstallModule023871.exe	84
PID 4712 wrote to memory of 5080	4712	InstallModule023871.exe	84
PID 4712 wrote to memory of 5492	4712	InstallModule023871.exe	90
PID 4712 wrote to memory of 5492	4712	InstallModule023871.exe	90
PID 4640 wrote to memory of 2024	4640	IsClosed.exe	94
PID 4640 wrote to memory of 2024	4640	IsClosed.exe	94
PID 4640 wrote to memory of 2024	4640	IsClosed.exe	94
PID 4640 wrote to memory of 2024	4640	IsClosed.exe	94
PID 4640 wrote to memory of 2024	4640	IsClosed.exe	94
PID 4640 wrote to memory of 2024	4640	IsClosed.exe	94
PID 1080 wrote to memory of 5880	1080	IsClosed.exe	96
PID 1080 wrote to memory of 5880	1080	IsClosed.exe	96
PID 1080 wrote to memory of 5880	1080	IsClosed.exe	96
PID 1080 wrote to memory of 5880	1080	IsClosed.exe	96
PID 1080 wrote to memory of 5880	1080	IsClosed.exe	96
PID 1080 wrote to memory of 5880	1080	IsClosed.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Installer_v510_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Installer_v510_x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\Installer_v510_x64.exe', 'C:\Users\Admin\AppData\Local', 'C:\Users\Admin\AppData\Roaming', 'C:\Users\Admin\AppData\Local', 'C:\Users\Admin\AppData\Roaming'); Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\Installer_v510_x64.exe'; Add-MpPreference -ExclusionProcess 'InstallModule023871.exe'; Add-MpPreference -ExclusionProcess 'InstallUtil.exe'; Add-MpPreference -ExclusionProcess 'MSBuild.exe'; Add-MpPreference -ExclusionProcess 'AddInProcess.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\InstallModule023871.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\InstallModule023871.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallModule023871.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "uodosxzr" /XML "C:\Users\Admin\AppData\Local\Temp\093ae8e596e64c56a7d677e3c8a5d474.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5080
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "IsClosed" /XML "C:\Users\Admin\AppData\Local\Temp\f2dfb19d8616454aa6de258c3dd9ff52.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local,C:\Users\Admin\AppData\Local\Temp\;Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\TypeId\nkrbokyp\IsClosed.exe;Add-MpPreference -ExclusionProcess C:\Users\Admin\AppData\Local\TypeId\nkrbokyp\IsClosed.exe;
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Users\Admin\AppData\Local\TypeId\nkrbokyp\IsClosed.exe
C:\Users\Admin\AppData\Local\TypeId\nkrbokyp\IsClosed.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2024

C:\Users\Admin\AppData\Local\TypeId\nkrbokyp\IsClosed.exe
C:\Users\Admin\AppData\Local\TypeId\nkrbokyp\IsClosed.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IsClosed.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IsClosed.exe.log
Size 838B
SHA256 d309ddf505140ba12b7ce857aa7e822f24523b86774d423bf1d74c0cf13ff63d
MD5 b2a93166280809b9da482126a28346f6
SHA1 13705957ad74170698714cc84624196176610f14
SHA512 924f31c62f16074ebce62227b417b5ba038cbb54f39390a722e2f934c939eed4b47e2d8dcc87727337d8ddef70466be905cd2e94b386a91ab1ff35b86f9c96fb
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52
MD5 6903d57eed54e89b68ebb957928d1b99
SHA1 fade011fbf2e4bc044d41e380cf70bd6a9f73212
SHA512 c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 c21da731f2c6fd00e49dad07a1fc06538b7c3c97cea5633c9e2d4c5bfa1631b8
MD5 06f3696a39917a2fb76292bcfe99988b
SHA1 de3ae860d151157fb906716c51f812ac4f32609b
SHA512 9e66275e23159cc59e6ef170421af05bae0175989e4aba2b29efbd5e75adf1005afa227e1914304601a53d540e31f5139f64a08c84239b74f7feadefd172647f
MD5 SHA1 SHA512

Submit Download

093ae8e596e64c56a7d677e3c8a5d474.xml

Path C:\Users\Admin\AppData\Local\Temp\093ae8e596e64c56a7d677e3c8a5d474.xml
Size 1KB
SHA256 deef5f44441c6f20789b4641ea3870d99e74e40afc5b98fd53031626892889c7
MD5 0fb91b3a45ba28d3b00ee2a568e4fc13
SHA1 95dff4804ec6891f15c5c48dbd2c8cbd54108d7a
SHA512 f39fbaae5b997db0a996a29032952cb487a7bd320114458c421682232d4fc4ad858391edeae175f28ccc04bcfeb2afa66c9e9636b1953bcbe64c416794bd6efe
MD5 SHA1 SHA512

Submit Download

InstallModule023871.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallModule023871.exe
Size 566KB
SHA256 08fab81476bf7a011da377ada5609521c48dd2d9f42cf4f0e6f78fb3b3d5c364
MD5 abc0a3ff60b2df676dd455abc79335f4
SHA1 9bca7647f125d95aab059c31dcdce5d24cffe36a
SHA512 288b4496ce3c9dc44721164435caf83609ebd8c074dd12086b2e95fa31cc9d6f7c26a48d14aae37056ca1d028a3a9ce6d891e08659cd566ff25ea4461f468e65
SSDEEP 12288:0tkwjUEcPryoBw3A6FI9wkED3xM0KJFLlSa1EMA2rIqN3oDo:Ukw4EAfwQ6FfR3bMLlSa1TA0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_w1znzhcm.qic.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1znzhcm.qic.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

f2dfb19d8616454aa6de258c3dd9ff52.xml

Path C:\Users\Admin\AppData\Local\Temp\f2dfb19d8616454aa6de258c3dd9ff52.xml
Size 1KB
SHA256 43d8e8f977f661b254af9c27593ca225523d5bde9b4c27abfca3f59692003765
MD5 848a04da7b03f784d4a572cb31cf8bd4
SHA1 61da5cce7b0a7744e13c3a59498c6be1710be1b2
SHA512 cf44077ed661e6c239fa6ac2e7137be6a5feadc41a33fa15a20da02d5891eda6b134491b6663374a327ee443ff462e7f5fb1be3b920873833cb349abf2931c60
MD5 SHA1 SHA512

Submit Download

memory/3904-23-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/3904-4-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/3904-0-0x0000000000400000-0x0000000001142000-memory.dmp

Download

memory/3904-18-0x0000000000400000-0x0000000001142000-memory.dmp

Download

memory/3904-2-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/3904-20-0x00007FF8472AA000-0x00007FF8472AB000-memory.dmp

Download

memory/3904-1-0x00007FF8472AA000-0x00007FF8472AB000-memory.dmp

Download

memory/3904-25-0x000000001F410000-0x000000001F4A4000-memory.dmp

Download

memory/3904-9-0x0000000000400000-0x0000000001142000-memory.dmp

Download

memory/3904-8-0x0000000000400000-0x0000000001142000-memory.dmp

Download

memory/3904-5-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/3904-61-0x0000000000400000-0x0000000001142000-memory.dmp

Download

memory/3904-60-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/3904-3-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/4712-40-0x000000001E400000-0x000000001E4F8000-memory.dmp

Download

memory/4712-39-0x0000000001F30000-0x0000000001FA0000-memory.dmp

Download

memory/4712-38-0x0000000000F80000-0x0000000001012000-memory.dmp

Download

memory/4996-49-0x000001175C9C0000-0x000001175CA06000-memory.dmp

Download

memory/5456-10-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/5456-19-0x00007FF847290000-0x00007FF84734D000-memory.dmp

Download

memory/5456-16-0x0000022332950000-0x0000022332972000-memory.dmp

Download