Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 04:08
General
- Target 410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587.exe
- Size 7.7MB
- Sample260528-eqayzagx71
- SHA256 410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587
Malware Config
Signatures
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587.exe"C:\Users\Admin\AppData\Local\Temp\410c02a282d786a5c585b20188195b593e42ebef4fa5faafb961f529b3887587.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4492-0-0x00007FF702D9C000-0x00007FF7031EF000-memory.dmp
memory/4492-1-0x00007FFCFE730000-0x00007FFCFE732000-memory.dmp
memory/4492-2-0x00007FFCFE740000-0x00007FFCFE742000-memory.dmp
memory/4492-3-0x00007FFCFD150000-0x00007FFCFD152000-memory.dmp
memory/4492-4-0x00007FFCFD160000-0x00007FFCFD162000-memory.dmp
memory/4492-5-0x00007FFCFC180000-0x00007FFCFC182000-memory.dmp
memory/4492-6-0x00007FFCFC190000-0x00007FFCFC192000-memory.dmp
memory/4492-8-0x00007FFCFE760000-0x00007FFCFE762000-memory.dmp
memory/4492-7-0x00007FFCFE750000-0x00007FFCFE752000-memory.dmp
memory/4492-9-0x00007FF702B10000-0x00007FF703999000-memory.dmp
memory/4492-16-0x00007FF702D9C000-0x00007FF7031EF000-memory.dmp
memory/4492-17-0x00000246926B0000-0x000002469272F000-memory.dmp
memory/4492-18-0x0000024695C00000-0x0000024695C6F000-memory.dmp
memory/4492-19-0x00007FF702B10000-0x00007FF703999000-memory.dmp