1fb0b048fb1fd76bdc7991a522e3e10cb5b6136a26faf7b1bdab9b870e90a0b2

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
joloBridge.exe
Size 180.0MB
Sample260505-2kr2maf12x
SHA256 1fb0b048fb1fd76bdc7991a522e3e10cb5b6136a26faf7b1bdab9b870e90a0b2
MD5 ce368a5e5dd3b58d55e70f3fc515e907
SHA1 1109fda0aa06a7469cd6db2acf371434b76a036a
SHA512 2ab9afddd777bec192fb1891378f4560c6425acf759dc04fa635865a95552b0b6673e93abda40096e1f8c872827fe74df775d9624497f2f7446045797b8ff7ff
SSDEEP 1572864:IH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:9sok+hK7
TLSH
T103988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	43bf058e1e967ee4.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	43bf058e1e967ee4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	43bf058e1e967ee4.exe

Executes dropped EXE 1 IoCs

pid	Process
856	43bf058e1e967ee4.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral11/files/0x000800000002450e-30.dat	themida
behavioral11/memory/856-34-0x0000000140000000-0x00000001407AA000-memory.dmp	themida
behavioral11/memory/856-33-0x0000000140000000-0x00000001407AA000-memory.dmp	themida
behavioral11/memory/856-35-0x0000000140000000-0x00000001407AA000-memory.dmp	themida
behavioral11/memory/856-40-0x0000000140000000-0x00000001407AA000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	43bf058e1e967ee4.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	joloBridge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5192	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2020	powershell.exe
2020	powershell.exe
4952	powershell.exe
4952	powershell.exe
856	43bf058e1e967ee4.exe
856	43bf058e1e967ee4.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeIncreaseQuotaPrivilege	2020	powershell.exe
Token: SeSecurityPrivilege	2020	powershell.exe
Token: SeTakeOwnershipPrivilege	2020	powershell.exe
Token: SeLoadDriverPrivilege	2020	powershell.exe
Token: SeSystemProfilePrivilege	2020	powershell.exe
Token: SeSystemtimePrivilege	2020	powershell.exe
Token: SeProfSingleProcessPrivilege	2020	powershell.exe
Token: SeIncBasePriorityPrivilege	2020	powershell.exe
Token: SeCreatePagefilePrivilege	2020	powershell.exe
Token: SeBackupPrivilege	2020	powershell.exe
Token: SeRestorePrivilege	2020	powershell.exe
Token: SeShutdownPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeSystemEnvironmentPrivilege	2020	powershell.exe
Token: SeRemoteShutdownPrivilege	2020	powershell.exe
Token: SeUndockPrivilege	2020	powershell.exe
Token: SeManageVolumePrivilege	2020	powershell.exe
Token: 33	2020	powershell.exe
Token: 34	2020	powershell.exe
Token: 35	2020	powershell.exe
Token: 36	2020	powershell.exe
Token: SeShutdownPrivilege	5220	joloBridge.exe
Token: SeCreatePagefilePrivilege	5220	joloBridge.exe
Token: SeDebugPrivilege	5192	taskkill.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	5220	joloBridge.exe
Token: SeCreatePagefilePrivilege	5220	joloBridge.exe
Token: SeShutdownPrivilege	5220	joloBridge.exe
Token: SeCreatePagefilePrivilege	5220	joloBridge.exe
Token: SeShutdownPrivilege	5220	joloBridge.exe
Token: SeCreatePagefilePrivilege	5220	joloBridge.exe
Token: SeShutdownPrivilege	5220	joloBridge.exe
Token: SeCreatePagefilePrivilege	5220	joloBridge.exe
Token: SeShutdownPrivilege	5220	joloBridge.exe
Token: SeCreatePagefilePrivilege	5220	joloBridge.exe
Token: SeShutdownPrivilege	5220	joloBridge.exe
Token: SeCreatePagefilePrivilege	5220	joloBridge.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 5124	5220	joloBridge.exe	85
PID 5220 wrote to memory of 5124	5220	joloBridge.exe	85
PID 5220 wrote to memory of 5364	5220	joloBridge.exe	86
PID 5220 wrote to memory of 5172	5220	joloBridge.exe	87
PID 5172 wrote to memory of 2020	5172	cmd.exe	89
PID 5220 wrote to memory of 5680	5220	joloBridge.exe	92
PID 5680 wrote to memory of 2752	5680	cmd.exe	94
PID 2752 wrote to memory of 964	2752	net.exe	95
PID 5220 wrote to memory of 3372	5220	joloBridge.exe	96
PID 3372 wrote to memory of 5192	3372	cmd.exe	98
PID 5220 wrote to memory of 4952	5220	joloBridge.exe	99
PID 5220 wrote to memory of 856	5220	joloBridge.exe	108

C:\Users\Admin\AppData\Local\Temp\joloBridge.exe
"C:\Users\Admin\AppData\Local\Temp\joloBridge.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Users\Admin\AppData\Local\Temp\joloBridge.exe
  "C:\Users\Admin\AppData\Local\Temp\joloBridge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\jolobridge-bgbc" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1780,i,637423592731014486,9391813584079708831,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  PID:5124
- C:\Users\Admin\AppData\Local\Temp\joloBridge.exe
  "C:\Users\Admin\AppData\Local\Temp\joloBridge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\jolobridge-bgbc" --field-trial-handle=1976,i,637423592731014486,9391813584079708831,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:3
  2⤵
  PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0AIABjAGEAdABjAGgAIAB7AH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\43bf058e1e967ee4.exe
  C:\Users\Admin\AppData\Local\Temp\43bf058e1e967ee4.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a11a49ebb43a98c5e15fbeeaa169b69436c076def7e138bba78cef83d1d6684b
MD5 913dd7235b05dee5ffc28ade76fd426d
SHA1 3da1dd1dee239ba84dd825e900eb42d7f863d677
SHA512 124810f88e59693a5db407dec8f4a0dcda8248e1a784a90acf686a08984625eb3c6e839eb8ae4f0d9b25b9ea8584a9123fbdfb0745673128b26dbfbe3a84bdee
TLSH
T185218727B39DC821CC99153A209CAC1172B683CB809ECF8F6FC0D224A07FAC4CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

43bf058e1e967ee4.exe

Path C:\Users\Admin\AppData\Local\Temp\43bf058e1e967ee4.exe
Size 3.2MB
SHA256 a189adbb13faf90306dd43c503ee41828a2f2fd52e43bd81b4549055951142f8
MD5 26a223cff7a2ee54425705f846d5710f
SHA1 7fc2ec33e5d818f9ea224f18473c997aec139ce9
SHA512 d209ef91c478dc377dc036a8f3aebe28ae603fc1e71942dead8edd9c77672b97c0d67233557e03da8d6e447b93e4c5145794d182966403ae4f7ac2dd228a8900
SSDEEP 98304:Ocu6NW5mUpsEnOfO9wODQvHlWfHjqE8d:Q6cDZwOyO0vFEDqE8
TLSH
T1C4F53347829A2337C6700E3D2D06CBA9863977EC6314730F7C5664709BAE795F60EE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ufvwds1d.b2c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ufvwds1d.b2c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/856-40-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/856-39-0x0000000003BC0000-0x0000000003C8D000-memory.dmp

Download

memory/856-48-0x0000000003BC0000-0x0000000003C8D000-memory.dmp

Download

memory/856-46-0x0000000003BC0000-0x0000000003C8D000-memory.dmp

Download

memory/856-44-0x0000000003BC0000-0x0000000003C8D000-memory.dmp

Download

memory/856-42-0x0000000003BC0000-0x0000000003C8D000-memory.dmp

Download

memory/856-34-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/856-33-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/856-35-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/2020-10-0x000001D275B00000-0x000001D275B2A000-memory.dmp

Download

memory/2020-2-0x000001D275660000-0x000001D275682000-memory.dmp

Download

memory/2020-11-0x000001D275B00000-0x000001D275B24000-memory.dmp

Download

memory/2020-14-0x000001D25D230000-0x000001D25D23C000-memory.dmp

Download

memory/4952-26-0x000001CED9C60000-0x000001CED9C6C000-memory.dmp

Download

memory/5124-36-0x000001A0424D0000-0x000001A0425E5000-memory.dmp

Download

memory/5192-15-0x00000190EAC80000-0x00000190EAD4D000-memory.dmp

Download

memory/5220-37-0x0000021374500000-0x0000021374615000-memory.dmp

Download