d78dd365a11d615b736bf3981e7b7c087c9509b8680bf1aa17bdfd53718ebf21

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 10.0MB
Sample260707-wrrrjsbv9v
SHA256 d78dd365a11d615b736bf3981e7b7c087c9509b8680bf1aa17bdfd53718ebf21
MD5 7e73b6dc000ff72e5dcdb05aa73af9fa
SHA1 2123b2d2dd10b6567613eba69f7dedde5d539bef
SHA512 cb7c07d22672b5e6e1405616a2b296c4b8c268e443ffb744fd6ab9048e033e9a563fc31004cc8aff07404a34e783fa10d71f3125065d1e549f24fb24c55b945a
SSDEEP 196608:UJ02GDeX5Fwe7Lf3GtDQN86xevz/8hfjsyAny4xocgyUCztNGCFM:UJkALfODK8NQLsyOZxv3CC
TLSH
T12EB633CD2FE98990F4275B72679BCA0915A3E8164F35732C69CB7C4C4CF7A8997B0608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
1280	ce_240765343.exe
2220	svchost.exe
3024	ce_240766500.exe
472	ce_240774781.exe
4540	ce_240775500.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4260-0-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/4260-1-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/4260-4-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/4260-2-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/4260-3-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/files/0x000d00000001c632-9.dat	themida
behavioral2/memory/4260-14-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/2220-15-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/2220-16-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/2220-17-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/2220-18-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/2220-37-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/4260-40-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/2220-41-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/2220-57-0x0000000140000000-0x00000001417BB000-memory.dmp	themida
behavioral2/memory/4260-67-0x0000000140000000-0x00000001417BB000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	svchost.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4260	loader.exe
2220	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
4260	loader.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe
2220	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1280	4260	loader.exe	87
PID 1280 wrote to memory of 3716	1280	ce_240765343.exe	90
PID 1280 wrote to memory of 3716	1280	ce_240765343.exe	90
PID 4260 wrote to memory of 3024	4260	loader.exe	94
PID 3024 wrote to memory of 460	3024	ce_240766500.exe	96
PID 3024 wrote to memory of 460	3024	ce_240766500.exe	96
PID 2220 wrote to memory of 472	2220	svchost.exe	97
PID 472 wrote to memory of 5052	472	ce_240774781.exe	99
PID 472 wrote to memory of 5052	472	ce_240774781.exe	99
PID 2220 wrote to memory of 4540	2220	svchost.exe	102
PID 4540 wrote to memory of 3540	4540	ce_240775500.exe	104
PID 4540 wrote to memory of 3540	4540	ce_240775500.exe	104

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\ce_240765343.exe
  "C:\Users\Admin\AppData\Local\Temp\ce_240765343.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_66922\Browsers\ce_raw" chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3716
- C:\Users\Admin\AppData\Local\Temp\ce_240766500.exe
  "C:\Users\Admin\AppData\Local\Temp\ce_240766500.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_66922\Browsers\ce_raw" edge
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1600

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\ce_240774781.exe
  "C:\Users\Admin\AppData\Local\Temp\ce_240774781.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_72625\Browsers\ce_raw" chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5052
- C:\Users\Admin\AppData\Local\Temp\ce_240775500.exe
  "C:\Users\Admin\AppData\Local\Temp\ce_240775500.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_72625\Browsers\ce_raw" edge
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 f5dacd90cc2cd4082e3284b6b491eab04ffd4883cdf2aed0570f949d7c24c1f1
MD5 d1814e6c56414328262e37ec6a9f4c1d
SHA1 399f31e3c473f33f405ff1d78014d940be61ba87
SHA512 7f5497c396b3fd861ffe21091fcb1bbef38146d9e6e1e6a17f10644091e79e6190080cbb1abd8da50e0cc29f6e66cffc4e50ea0c522a4c6f473f45054900d6a3
TLSH
T1DA41D8EE6E1C3064FF828E494774C6323E79B1D1D4C0556970FE88F22195BD13C1649D
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 bf7d867cc89ba8dc90a886b249ab3ec613b875444830865fcb8b9d1d0a4d5f20
MD5 323cb42ad2e225ae2a2f8f01ccf4eb28
SHA1 7b42e5c39059ca670ee0b5e21a07d821e45c03c5
SHA512 c0226bae36fcfaa7d92ee7000e9830183403b455c8bc13c0f0e9c7c771369ee38176bd189c1cd1de5d4194275ae57b07b5d44d43465b312ce0e2229a89d1ecfa
TLSH
T14041E7EB2B4A7828BE058F8AADB9CA3D1D7881A451802CC1F562C8A1749DBD15C4B98D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 3a5cacbab57aa2d770af205f6106c89dc6b9dccc7411bd0228dca439fbc1bfb6
MD5 8f7cea9297b056218a83be3345ca9509
SHA1 e0e76aba94dbda42d6a3760f4281858c6fe123fa
SHA512 378a0b1f8c6f58a26686e2b0513c89e0ad00735dddd0918d082c6a5163cc61782a871dec402097baf85aa25ffee5c4d944d51162b857993b104a58a008addf18
TLSH
T184F026647DFE917BF1379A3A1BC631F919AAF21320162DBA127527082F21F106D92A09
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 da03c8b20bb7b29ea055bbf472cf4f957789b20300a14eece9abdc3120fe8e99
MD5 0a7b9e17329dadd30cf63db404fab528
SHA1 bc0c8cacbb2f2f172c0b714d67fa60f8f358651d
SHA512 0b857c80f542fdd9e7433141c2f5ff622da6e15f72b3a811e53faaa19a331aa7c86b26cbac9cf3251758b81de187a10805481559022aa3453fb238aaf9e1a298
TLSH
T123F0AB3C34E7000EF266C6B90AD636D7CA23F13632082A9CAEB203042E42D00BCA1A15
MD5 SHA1 SHA512 TLSH

Submit Download

ce_240765343.exe

Path C:\Users\Admin\AppData\Local\Temp\ce_240765343.exe
Size 1.4MB
SHA256 08943baad0716d4b096cd2efc9210881168c4a42f138fb8300742e00e8fa18aa
MD5 aeab1859f072f6fcfcecefbd6a544e96
SHA1 21da8d15e60180e7c2bfe076b483ec15a89050d0
SHA512 40610911af491358e8639cc38090064cdcc86b6603afe00a791b82c4f126fe511e6ed375fda6886e04b790350c625779e020257b341d95d61a39d22789f55e17
SSDEEP 24576:K6kuBffuufAPyE8ru5pdLNT64UnrNwUsgskBnakrqD0sz/eM:KMBXu+A6rrGLNT8h7b+A/M
TLSH
T16665021BA7A500FDD5EBD274CC42190ADB72F80A4B60E68F07D54A961F277B09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
Size 10.0MB
SHA256 d78dd365a11d615b736bf3981e7b7c087c9509b8680bf1aa17bdfd53718ebf21
MD5 7e73b6dc000ff72e5dcdb05aa73af9fa
SHA1 2123b2d2dd10b6567613eba69f7dedde5d539bef
SHA512 cb7c07d22672b5e6e1405616a2b296c4b8c268e443ffb744fd6ab9048e033e9a563fc31004cc8aff07404a34e783fa10d71f3125065d1e549f24fb24c55b945a
SSDEEP 196608:UJ02GDeX5Fwe7Lf3GtDQN86xevz/8hfjsyAny4xocgyUCztNGCFM:UJkALfODK8NQLsyOZxv3CC
TLSH
T12EB633CD2FE98990F4275B72679BCA0915A3E8164F35732C69CB7C4C4CF7A8997B0608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2220-17-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/2220-41-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/2220-15-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/2220-16-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/2220-57-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/2220-18-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/2220-37-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-40-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-14-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-0-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-3-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-2-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-4-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-1-0x0000000140000000-0x00000001417BB000-memory.dmp

Download

memory/4260-67-0x0000000140000000-0x00000001417BB000-memory.dmp

Download