f9a3d37d50ef9cfaf8bace3e50767e1b8ada51dd15da014d1dcfff420557efe0

Analysis

user interaction
yes
max time kernel
80s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 4.5MB
Sample260717-bghexag13l
SHA256 f9a3d37d50ef9cfaf8bace3e50767e1b8ada51dd15da014d1dcfff420557efe0
MD5 b09a717aa807f38ab74b56fcc6c5c531
SHA1 1fc0ef2afb584de047985c265eec845e2d3ed81d
SHA512 49e557288e7e2553be43b604ad4db6fe9f389bacb3868e1f786b407176ee5149865d4d7a911b2c7d125f4d26282c5d99b0915b071fa98d8c452e3d16b5c8858b
SSDEEP 98304:E6GUPAfIZfLyl9/daqVIYyYCaD25lVrI212N0:DIwZC/AGrCaanVn12m
TLSH
T12426331FC41590B6DE7444B29D780E9DFB39E69B0E308E440D3B1A4BEE89E390A5C6F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Loader.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5704-0-0x00007FF69E7D0000-0x00007FF69F42E000-memory.dmp	themida
behavioral2/memory/5704-1-0x00007FF69E7D0000-0x00007FF69F42E000-memory.dmp	themida
behavioral2/memory/5704-4-0x00007FF69E7D0000-0x00007FF69F42E000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5704	Loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5704	Loader.exe
5704	Loader.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5704-0-0x00007FF69E7D0000-0x00007FF69F42E000-memory.dmp

Download

memory/5704-1-0x00007FF69E7D0000-0x00007FF69F42E000-memory.dmp

Download

memory/5704-2-0x00007FF69E7E1000-0x00007FF69E7E2000-memory.dmp

Download

memory/5704-4-0x00007FF69E7D0000-0x00007FF69F42E000-memory.dmp

Download