c634669bd0bf5c75d77fd8fcea886d41cf9c1af1fab83ecc7134b20b52b75654

Resubmissions

21/07/2026, 01:47

260721-b7p8faby2r

21/07/2026, 01:39

260721-b2ymmadv3x7

Analysis

user interaction
yes
max time kernel
24s
max time network
26s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
21/07/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N7 STORE Loader.exe
Size 6.3MB
Sample260721-b2ymmadv3x
SHA256 c634669bd0bf5c75d77fd8fcea886d41cf9c1af1fab83ecc7134b20b52b75654
MD5 f39b2a354a6a03b172d80b28f64fb6a2
SHA1 3b8742eae924623a4f5f1a82154efcf0b82f9107
SHA512 459a5553fd620c7801478c7b6e94e383246127b5e90ed7fe9b537163a882d5dd4b2fe45a79a6325fec4ab27fbf583fb31f1e20d71c20be335e9d9dec4b6894d4
SSDEEP 98304:JivRMxkpbfdHnXhCaFQvk/H2wt63b+CQakYR1N+cPUoXxEN+ObKCF6XiUICKH6ie:Of9NQvkPY3bAahnceEsO36XiWEWAWq7
TLSH
T1F26622ED6284739CC00EC8349837FC44B1F5962E1AD795AE7ACB7AD0BB9E420D641B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/392-3-0x00007FF6E6920000-0x00007FF6E74C9000-memory.dmp	vmprotect
behavioral1/memory/392-8-0x00007FF6E6920000-0x00007FF6E74C9000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
392	N7 STORE Loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3832	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
392	N7 STORE Loader.exe
392	N7 STORE Loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3832	392	N7 STORE Loader.exe	83
PID 3832 wrote to memory of 4692	3832	cmd.exe	85
PID 3832 wrote to memory of 3764	3832	cmd.exe	86
PID 3832 wrote to memory of 1932	3832	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\N7 STORE Loader.exe
"C:\Users\Admin\AppData\Local\Temp\N7 STORE Loader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\N7 STORE Loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\N7 STORE Loader.exe" MD5
    3⤵
    PID:4692
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3764
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-0-0x00007FF6E6AF6000-0x00007FF6E6E7C000-memory.dmp

Download

memory/392-3-0x00007FF6E6920000-0x00007FF6E74C9000-memory.dmp

Download

memory/392-2-0x00007FFAD9F40000-0x00007FFAD9F42000-memory.dmp

Download

memory/392-1-0x00007FFAD9F30000-0x00007FFAD9F32000-memory.dmp

Download

memory/392-7-0x00007FF6E6AF6000-0x00007FF6E6E7C000-memory.dmp

Download

memory/392-8-0x00007FF6E6920000-0x00007FF6E74C9000-memory.dmp

Download