Analysis
- user interaction
yes - max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 19:41
General
- Target RE GURU.exe
- Size 42.3MB
- Sample260705-yecszaft5w
- SHA256 f09eac6ada344e905ae19e49a885d6c8e830154650a41ea5fb3b8fab79cca6a3
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Drops file in Drivers directory 1 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
- Drops file in Program Files directory 2 IoCs
- Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RE GURU.exe"C:\Users\Admin\AppData\Local\Temp\RE GURU.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PJjY 4DLwYEv\vWO SYOdpq.exe"C:\Users\Admin\AppData\Local\Temp\PJjY 4DLwYEv\vWO SYOdpq.exe" "RG_9f2K7pQm4Zv8Lt|RE GURU.exe|C:\Users\Admin\AppData\Local\Temp\RE GURU.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn "MicrosoftWinCfgSvc"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /rl HIGHEST /sc ONCE /st 00:00 /tn "MicrosoftWinCfgSvc" /tr "\"C:\Program Files (x86)\Microsoft\WinCfg\wincfgsvc.exe\" --svc"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files (x86)\Microsoft\WinCfg\wincfgsvc.exe"C:\Program Files (x86)\Microsoft\WinCfg\wincfgsvc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
vWO SYOdpq.exe
memory/3044-34-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-45-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-37-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-39-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-42-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-44-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-43-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-41-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-40-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/3044-38-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5392-7-0x0000000077D5A000-0x0000000077D5C000-memory.dmp
memory/5392-13-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5392-1-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5392-2-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5392-3-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5392-4-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5392-5-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5392-6-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5392-0-0x0000000000400000-0x0000000005026000-memory.dmp
memory/5832-22-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-15-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-16-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-31-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-30-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-23-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-17-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-21-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-20-0x0000000000400000-0x0000000003D53000-memory.dmp
memory/5832-19-0x0000000000400000-0x0000000003D53000-memory.dmp