Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/05/2026, 04:08
General
- Target 410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587.exe
- Size 7.7MB
- Sample260528-eqayzagx71
- SHA256 410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587
Malware Config
Signatures
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587.exe"C:\Users\Admin\AppData\Local\Temp\410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2168-0-0x00007FF6638EC000-0x00007FF663D3F000-memory.dmp
memory/2168-1-0x00007FFA21610000-0x00007FFA21612000-memory.dmp
memory/2168-3-0x00007FFA213D0000-0x00007FFA213D2000-memory.dmp
memory/2168-2-0x00007FFA21620000-0x00007FFA21622000-memory.dmp
memory/2168-4-0x00007FFA213E0000-0x00007FFA213E2000-memory.dmp
memory/2168-6-0x00007FFA1EE40000-0x00007FFA1EE42000-memory.dmp
memory/2168-5-0x00007FFA1EE30000-0x00007FFA1EE32000-memory.dmp
memory/2168-8-0x00007FFA21640000-0x00007FFA21642000-memory.dmp
memory/2168-10-0x00007FF663660000-0x00007FF6644E9000-memory.dmp
memory/2168-7-0x00007FFA21630000-0x00007FFA21632000-memory.dmp
memory/2168-16-0x00007FF6638EC000-0x00007FF663D3F000-memory.dmp
memory/2168-17-0x00007FF663660000-0x00007FF6644E9000-memory.dmp