Analysis
- user interaction
yes - max time kernel
10s - max time network
77s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
21/07/2026, 04:08
General
- Target illusion.exe
- Size 61.6MB
- Sample260721-eqa9qsew2k
- SHA256 b4da32ba5a9f2b9f40aaa6381c9e4cc699cfd7f9704ef19e848a4d3cf6152a0d
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 21 IoCs
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\illusion.exe"C:\Users\Admin\AppData\Local\Temp\illusion.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ElevationLoader\runtime\illusion\d45530287d5026a68201fbe80ace1779f53ecc8a0e705dab021d72b25855e306\illusion.exe"C:\Users\Admin\AppData\Local\ElevationLoader\runtime\illusion\d45530287d5026a68201fbe80ace1779f53ecc8a0e705dab021d72b25855e306\illusion.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6OpenGL.dll
Qt6Qml.dll
Qt6QmlModels.dll
Qt6QmlWorkerScript.dll
Qt6Quick.dll
Qt6QuickControls2.dll
Qt6QuickControls2Impl.dll
Qt6QuickLayouts.dll
Qt6QuickTemplates2.dll
illusion.exe
qwindows.dll
qmldir
qmldir
qmldir
workerscriptplugin.dll
qmldir
qmldir
qtquickcontrols2basicstyleplugin.dll
qmldir
qtquickcontrols2materialstyleplugin.dll
qmldir
qtquickcontrols2implplugin.dll
qmldir
qtquickcontrols2plugin.dll
qmldir
qquicklayoutsplugin.dll
qmldir
qtquicktemplates2plugin.dll
qmldir
quickwindow.qmltypes
quickwindowplugin.dll
qmldir
qcertonlybackend.dll
qopensslbackend.dll
qschannelbackend.dll
qt_en.qm
memory/4352-614-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-612-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-559-0x00000157D4CC0000-0x00000157D4CC1000-memory.dmp
memory/4352-557-0x00007FFC56560000-0x00007FFC56AA3000-memory.dmp
memory/4352-558-0x00007FFC56560000-0x00007FFC56AA3000-memory.dmp
memory/4352-607-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-608-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-609-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-610-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-570-0x00000157D5A70000-0x00000157D5C72000-memory.dmp
memory/4352-613-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-568-0x00000157D5620000-0x00000157D5A62000-memory.dmp
memory/4352-611-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-619-0x00000157DC110000-0x00000157DC117000-memory.dmp
memory/4352-620-0x00000157DC110000-0x00000157DC117000-memory.dmp
memory/4352-621-0x00000157DC120000-0x00000157DC124000-memory.dmp
memory/4352-622-0x00000157DC120000-0x00000157DC124000-memory.dmp
memory/4352-625-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-626-0x00000157D6C40000-0x00000157D6C41000-memory.dmp
memory/4352-628-0x00000157DC120000-0x00000157DC124000-memory.dmp
memory/4352-627-0x00000157DC120000-0x00000157DC124000-memory.dmp
memory/4352-629-0x00000157DC110000-0x00000157DC117000-memory.dmp