Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 16:10
General
- Target Fz1.1.9/Module.dll
- Size 14.2MB
- Sample260417-tmlzdsft6w
- SHA256 7def081958aff89d50e9c19cbc295fee5fd72ed1e24340c72ce1aaa77c967c00
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Fz1.1.9\Module.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Badlisted process makes network request
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4324-0-0x0000000180000000-0x0000000182684000-memory.dmp
memory/4324-1-0x0000000180000000-0x0000000182684000-memory.dmp
memory/4324-2-0x0000000180000000-0x0000000182684000-memory.dmp
memory/4324-4-0x0000000180000000-0x0000000182684000-memory.dmp
memory/4324-3-0x0000000180000000-0x0000000182684000-memory.dmp
memory/4324-6-0x000002938B960000-0x000002938B96C000-memory.dmp
memory/4324-5-0x0000000180000000-0x0000000182684000-memory.dmp
memory/4324-7-0x0000000180000000-0x0000000182684000-memory.dmp
memory/4324-9-0x000002938B960000-0x000002938B96C000-memory.dmp
memory/4324-8-0x0000000180000000-0x0000000182684000-memory.dmp