9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
Size 793KB
Sample260719-3qetxsbs8v
SHA256 9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f
MD5 db52f9b49d119e4d94e754c77494d617
SHA1 6f509b493a74ad4c7c6c0c5f8bae7adc9a88e539
SHA512 b560709be0e61da2f4553312daf3863180fae445ef528752dbac8037092e0285c14d9e65ec9399064e773579ae1825d301841cb9e2357db4b5d83ece78580580
SSDEEP 12288:T4mjxA4qCmwhFFoBCJp6/X72/mCCjZgMX84hSlduBZIw6Ev:T4m1A9bSoBCJu7XZF844hzEv
TLSH
T12A05E01AB61D58FDE01AC071825506779A31B4CA0B506AFF81D42A393FAAFF11F3A71D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox DLL files 2 TTPs 10 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\windows\System32\vboxdisp.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxmrxnp.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxogl.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxoglarrayspu.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxoglcrutil.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxoglerrorspu.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxoglpackspu.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxhook.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxoglfeedbackspu.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\vboxoglpassthroughspu.dll	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe

Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\windows\System32\Drivers\VBoxMouse.sys	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\Drivers\VBoxGuest.sys	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\Drivers\VBoxSF.sys	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\Drivers\VBoxVideo.sys	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe

Looks for VirtualBox executables on disk 2 TTPs 3 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\windows\System32\vboxservice.exe	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\VBoxTray.exe	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
File opened (read-only)	C:\windows\System32\VBoxControl.exe	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe

Looks for VMWare drivers on disk 2 TTPs 1 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\windows\System32\Drivers\Vmmouse.sys	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2692	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
2692	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2692	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
2692	9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe

C:\Users\Admin\AppData\Local\Temp\9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe
"C:\Users\Admin\AppData\Local\Temp\9c4fd10864c9599ee8029d5f0541d8cd996b5b1832ed1b4432873285c0d05a8f.exe"
1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads