b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe
Size 11.4MB
Sample260620-1v7dmaay6x
SHA256 b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba
MD5 40cbcb6bf953f2953581757420fced18
SHA1 900beabe327834536b897d67287da1f3c54e0b2d
SHA512 3681df0ca0b3ca64b4b7bb966d7571d9e8c0d7535e72271f6b9512cb83fe67f098f6c2ed6769d0c201dd1a623cdf3fc45e27c76144e1cedbf2cd78a90a83a5c1
SSDEEP 196608:ix/2hUd2I5mhmEaFF+dTDs6pOyVhNFrHMWQIFFkMMs2xHnUX3oUW2D1odA4MpOjx:i3dDDEoc86pOyVhTrHMgFPMJSX3dxh90
TLSH
T1F1C61295A4D5C2FDC845C470E24829FDF0DA78594EBD593B7FCA88122971C48C8FABB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	upd_240730031.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1172	powershell_core.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	upd_240730031.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	upd_240730031.exe

Executes dropped EXE 2 IoCs

pid	Process
1172	powershell_core.exe
5840	upd_240730031.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\powershell_core.exe"	_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000400000001b6f2-26.dat	themida
behavioral2/memory/5840-27-0x0000000140000000-0x00000001406FE000-memory.dmp	themida
behavioral2/memory/5840-28-0x0000000140000000-0x00000001406FE000-memory.dmp	themida
behavioral2/memory/5840-29-0x0000000140000000-0x00000001406FE000-memory.dmp	themida
behavioral2/memory/5840-33-0x0000000140000000-0x00000001406FE000-memory.dmp	themida
behavioral2/memory/5840-34-0x0000000140000000-0x00000001406FE000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	upd_240730031.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2684	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4880	_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe
4880	_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe
1172	powershell_core.exe
1172	powershell_core.exe
5840	upd_240730031.exe
5840	upd_240730031.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2956	4880	_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe	89
PID 2956 wrote to memory of 2684	2956	cmd.exe	91
PID 4880 wrote to memory of 1172	4880	_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe	93
PID 1172 wrote to memory of 5840	1172	powershell_core.exe	94

C:\Users\Admin\AppData\Local\Temp\_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe
"C:\Users\Admin\AppData\Local\Temp\_b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba.exe"
1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell_core.exe > nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell_core.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\upd_240730031.exe
    "C:\Users\Admin\AppData\Local\Temp\upd_240730031.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

client.log

Path C:\Users\Admin\AppData\Local\Temp\client.log
Size 434B
SHA256 ed14a12371d07cacb8d9dfef7793c4b9c08fb374e6c5b8da8525a0b7b278ef06
MD5 f8cdddb5907f236b5dcc3e5d921ecc22
SHA1 97f4b5414207e367f15db31c7d396b1a7cabceec
SHA512 7223d6a40f0b02b8fba3ff30e678805a4d5837abd53ffce1296724ce6601a9ff2e4cc482ba7bcdd9da3e9e3ef73d68519a38099671770198616c1c16ea6f1a45
TLSH
T159E0A783126A417FEA72E4C926C925989AA825152660DA19375C68493B6608C9B3D0F1
MD5 SHA1 SHA512 TLSH

Submit Download

upd_240730031.exe

Path C:\Users\Admin\AppData\Local\Temp\upd_240730031.exe
Size 2.9MB
SHA256 afac970888a621eb5a408c1820d941839c28ce4fbc351dfa0d23402f04fcd3bc
MD5 4b835dd01dbb7a0c03c62890338df8e7
SHA1 78fb18d81f24dfb070dee1c754dc801c66973045
SHA512 8145852d7c033ca69db3945602dc432d2fc7be7245a578ab46ef032eb8c3b2126a2499d5e49612adfa76b8db1bf1aec1d13884e6f6f769cd2f6f225499188fb6
SSDEEP 49152:tmu3B4Dk1D5xCFaqcKcUxg8aI1vOKc0vQqd5XeBVKVdpvoWoYolJoy7nHfEKhWM4:tmaXk+lUxUIM5qdsBVKVdpg7ncMv/bRa
TLSH
T198E523867B44E047D61E5EB9E962C3AC2762FE1A9B58970B30D0BD1F7CC66E31D84183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell_core.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\powershell_core.exe
Size 11.4MB
SHA256 b1d863f55530e9f30b6d80d9930a638581e6c00674d5e25cb38b88911cc0ccba
MD5 40cbcb6bf953f2953581757420fced18
SHA1 900beabe327834536b897d67287da1f3c54e0b2d
SHA512 3681df0ca0b3ca64b4b7bb966d7571d9e8c0d7535e72271f6b9512cb83fe67f098f6c2ed6769d0c201dd1a623cdf3fc45e27c76144e1cedbf2cd78a90a83a5c1
SSDEEP 196608:ix/2hUd2I5mhmEaFF+dTDs6pOyVhNFrHMWQIFFkMMs2xHnUX3oUW2D1odA4MpOjx:i3dDDEoc86pOyVhTrHMgFPMJSX3dxh90
TLSH
T1F1C61295A4D5C2FDC845C470E24829FDF0DA78594EBD593B7FCA88122971C48C8FABB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-13-0x00007FF763A70000-0x00007FF764D4F000-memory.dmp

Download

memory/1172-12-0x00007FF869E10000-0x00007FF869E12000-memory.dmp

Download

memory/4880-5-0x00007FF7B3BF0000-0x00007FF7B4ECF000-memory.dmp

Download

memory/4880-10-0x00007FF7B3C66000-0x00007FF7B435D000-memory.dmp

Download

memory/4880-11-0x00007FF7B3BF0000-0x00007FF7B4ECF000-memory.dmp

Download

memory/4880-0-0x00007FF7B3C66000-0x00007FF7B435D000-memory.dmp

Download

memory/4880-2-0x00007FF7B3BF0000-0x00007FF7B4ECF000-memory.dmp

Download

memory/4880-1-0x00007FF869E10000-0x00007FF869E12000-memory.dmp

Download

memory/5840-27-0x0000000140000000-0x00000001406FE000-memory.dmp

Download

memory/5840-28-0x0000000140000000-0x00000001406FE000-memory.dmp

Download

memory/5840-29-0x0000000140000000-0x00000001406FE000-memory.dmp

Download

memory/5840-33-0x0000000140000000-0x00000001406FE000-memory.dmp

Download

memory/5840-34-0x0000000140000000-0x00000001406FE000-memory.dmp

Download