Resubmissions
18/07/2026, 02:03
260718-cgp1escx5p818/07/2026, 02:01
260718-cfxc4scx2m418/07/2026, 01:58
260718-cd65jagt4x4Analysis
- max time kernel
900s - max time network
490s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
18/07/2026, 01:58
General
- Target loader.exe
- Size 16.9MB
- Sample260718-cd65jagt4x
- SHA256 f7e9680c3a5f90532bb6f9018347fff8f46798583afbbc04c7701317a5af8a57
Score
4/10
Malware Config
Signatures
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5516-1-0x00007FFAE7CF0000-0x00007FFAE7CF2000-memory.dmp
memory/5516-0-0x00007FF6ED79D000-0x00007FF6EE21C000-memory.dmp
memory/5516-8-0x0000023058EC0000-0x0000023058EC1000-memory.dmp
memory/5516-7-0x0000023058EC0000-0x0000023058EC1000-memory.dmp
memory/5516-6-0x0000023058EC0000-0x0000023058EC1000-memory.dmp
memory/5516-9-0x00007FF6ED6E0000-0x00007FF6EF2FF000-memory.dmp
memory/5516-10-0x00007FF6ED6E0000-0x00007FF6EF2FF000-memory.dmp
memory/5516-11-0x00007FF6ED6E0000-0x00007FF6EF2FF000-memory.dmp
memory/5516-12-0x00007FF6ED79D000-0x00007FF6EE21C000-memory.dmp