23140d2b2fd8c4f94c66089c4a1b41d61ebb6a5310a33681ce5afdee34dbed2c

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Streamer2.exe
Size 3.3MB
Sample260511-v4npzsfy21
SHA256 23140d2b2fd8c4f94c66089c4a1b41d61ebb6a5310a33681ce5afdee34dbed2c
MD5 754e7ae73e6c47c497a5fcac847bb760
SHA1 a5f7bd445be55e15841de99173e12211620b157e
SHA512 93e5eccef4657bd54d8ac6f32a235102d43ecd5134e2ae0b492d59af562bf3e94972897ec6a4e4f6712cdaafaeb8d85f59905f76fd39cbc6116aa8c7520ce8ab
SSDEEP 49152:/3UZmvUizUEZMygl+/F3w6E18HzCB4AlgJ+BFIcbzMZfnxYynakWJ0Si:nuyglOxGvsnxYyna/S
TLSH
T152F59D1AB2B901F8C0A7C5798A178D13EA72745903729BEF17E089652F23AF05F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3672	5314204140622312.exe
3288	3541051350242046.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	Streamer2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Streamer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Streamer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Streamer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	Streamer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	Streamer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Streamer2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Streamer2.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Streamer2.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Streamer2.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Streamer2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Streamer2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	Streamer2.exe
1852	Streamer2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	Streamer2.exe
Token: SeSystemEnvironmentPrivilege	2024	Streamer2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3672	1852	Streamer2.exe	79
PID 2024 wrote to memory of 3288	2024	Streamer2.exe	83

C:\Users\Admin\AppData\Local\Temp\Streamer2.exe
"C:\Users\Admin\AppData\Local\Temp\Streamer2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\5314204140622312.exe
  "C:\Users\Admin\AppData\Local\Temp\5314204140622312.exe" --binder-child
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Users\Admin\AppData\Local\Temp\Streamer2.exe
  "C:\Users\Admin\AppData\Local\Temp\Streamer2.exe"
  2⤵
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\TEMP\3541051350242046.exe
    "C:\Windows\TEMP\3541051350242046.exe" --binder-child
    3⤵
    - Executes dropped EXE
    PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5314204140622312.exe

Path C:\Users\Admin\AppData\Local\Temp\5314204140622312.exe
Size 19KB
SHA256 f1c52e25478245c4f2f379d882f2a53d86faa5aba41801d50ba4cc1980f7cf47
MD5 9ab8bd2717e93d8803657dd3666ffe81
SHA1 4b7fa3b384d51244a90b5457ecdadd3d77758c74
SHA512 b803e73d0ad5a9c03d1a6f95ae00806ea9368a05272c16df77604d216fd836ae2a898706c6b0d43c89eb3ad3885690692665fdb808df972b4978e433e0772fdd
SSDEEP 384:17DW4wJXqqYW9Nqd738td4EWYKfqApisi3aE:1nWX0qYU098t0imq3
TLSH
T197926C16F34609EED5276134C8A3224ED2B2330D1323DB9F17A985665E725D0BC3E7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1852-10-0x000001D6FE160000-0x000001D6FE16C000-memory.dmp

Download

memory/1852-8-0x000001D6FDCB0000-0x000001D6FE11C000-memory.dmp

Download

memory/2024-19-0x0000015380360000-0x000001538036C000-memory.dmp

Download

memory/2024-18-0x00000153FE320000-0x00000153FE78C000-memory.dmp

Download

memory/2024-24-0x0000015380860000-0x0000015380872000-memory.dmp

Download

memory/2024-40-0x0000015380530000-0x0000015380531000-memory.dmp

Download

memory/2024-41-0x0000015380530000-0x0000015380531000-memory.dmp

Download

memory/2024-43-0x0000015380360000-0x000001538036C000-memory.dmp

Download

memory/2024-42-0x00000153FE320000-0x00000153FE78C000-memory.dmp

Download