9154c2a77a5ed2c0b73be16f78945508893ba958fec4cfe792a539967960521d

Analysis

user interaction
yes
max time kernel
58s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V$ loader/V4 loader.exe
Size 1.7MB
Sample260705-spqvpac17w
SHA256 9154c2a77a5ed2c0b73be16f78945508893ba958fec4cfe792a539967960521d
MD5 16095dab261597982337eca420fab25e
SHA1 a4a38dd19919703012a8148fff80ebf2921891c0
SHA512 1f05eefa27cfb451e84afc9af2a918f2141789c40fd3995d3c457d7ee80faa573ab46cc4b60caeafa1e3755b6a080be2c7b252e478408387294a6d27d3181465
SSDEEP 24576:7si/mDEo7fzE7pcqpfkG4cy/VU4Om+EfX+UbjeuR7YwL:WDV7fzapcqpfkGeU4OFOtHeuR7Y
TLSH
T1A385180EAAB682E5D0BAD07CC692A52BFC31345A83305BE356999F532F277E4D53D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

persistence

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c66b-2.dat	disable_win_def

Executes dropped EXE 2 IoCs

pid	Process
4836	RuntimeBroker.exe
8	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\RuntimeBroker.exe"	V4 loader.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
948	V4 loader.exe
948	V4 loader.exe
4836	RuntimeBroker.exe
4836	RuntimeBroker.exe
8	RuntimeBroker.exe
8	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 4836	948	V4 loader.exe	88

C:\Users\Admin\AppData\Local\Temp\V$ loader\V4 loader.exe
"C:\Users\Admin\AppData\Local\Temp\V$ loader\V4 loader.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4836

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\RuntimeBroker.exe
Size 1.7MB
SHA256 9154c2a77a5ed2c0b73be16f78945508893ba958fec4cfe792a539967960521d
MD5 16095dab261597982337eca420fab25e
SHA1 a4a38dd19919703012a8148fff80ebf2921891c0
SHA512 1f05eefa27cfb451e84afc9af2a918f2141789c40fd3995d3c457d7ee80faa573ab46cc4b60caeafa1e3755b6a080be2c7b252e478408387294a6d27d3181465
SSDEEP 24576:7si/mDEo7fzE7pcqpfkG4cy/VU4Om+EfX+UbjeuR7YwL:WDV7fzapcqpfkGeU4OFOtHeuR7Y
TLSH
T1A385180EAAB682E5D0BAD07CC692A52BFC31345A83305BE356999F532F277E4D53D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.log

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\bot.log
Size 180B
SHA256 53c148ea938da4e8dbc82cd95b462c88a16b40314d110fa02b7e8000e5e5b432
MD5 e0711f85369d4612816e6aa25d8e70c0
SHA1 c4bf505f46b405e63f99dbce9927762bc4b31cfb
SHA512 3a329ff372361154922527c49a8480946fe30315422fe376a814a4b4aa04b9d521aae4f3fc73fe3a54aa135275b09cb40c20fc569b9fd5d135223113a1f0db65
TLSH
T10EC012AA02200A2A82800201C28A82C0A232F0A0E20EF02083D604EC6A418E38BED823
MD5 SHA1 SHA512 TLSH

Submit Download