Analysis
- max time kernel
151s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/07/2026, 04:08
General
- Target illusion.exe
- Size 61.6MB
- Sample260721-eqa9qsew2k
- SHA256 b4da32ba5a9f2b9f40aaa6381c9e4cc699cfd7f9704ef19e848a4d3cf6152a0d
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 37 IoCs
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\illusion.exe"C:\Users\Admin\AppData\Local\Temp\illusion.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ElevationLoader\runtime\illusion\d45530287d5026a68201fbe80ace1779f53ecc8a0e705dab021d72b25855e306\illusion.exe"C:\Users\Admin\AppData\Local\ElevationLoader\runtime\illusion\d45530287d5026a68201fbe80ace1779f53ecc8a0e705dab021d72b25855e306\illusion.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6OpenGL.dll
Qt6Qml.dll
Qt6QmlModels.dll
Qt6QmlWorkerScript.dll
Qt6Quick.dll
Qt6QuickControls2.dll
Qt6QuickControls2Impl.dll
Qt6QuickLayouts.dll
Qt6QuickTemplates2.dll
illusion.exe
qwindows.dll
qmldir
qmldir
qmldir
workerscriptplugin.dll
qmldir
qmldir
qtquickcontrols2basicstyleplugin.dll
qmldir
qtquickcontrols2materialstyleplugin.dll
qmldir
qtquickcontrols2implplugin.dll
qmldir
qtquickcontrols2plugin.dll
qmldir
qquicklayoutsplugin.dll
qmldir
quickwindow.qmltypes
quickwindowplugin.dll
qmldir
qcertonlybackend.dll
qopensslbackend.dll
qschannelbackend.dll
qt_en.qm
memory/3376-607-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-606-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-613-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-611-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-610-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-573-0x000001AE279F0000-0x000001AE27BF2000-memory.dmp
memory/3376-571-0x000001AE275A0000-0x000001AE279E2000-memory.dmp
memory/3376-609-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-608-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-612-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-561-0x00007FFE2F290000-0x00007FFE2F7D3000-memory.dmp
memory/3376-562-0x000001AE26380000-0x000001AE26381000-memory.dmp
memory/3376-621-0x000001AE2E210000-0x000001AE2E217000-memory.dmp
memory/3376-620-0x000001AE2E210000-0x000001AE2E217000-memory.dmp
memory/3376-622-0x000001AE2E430000-0x000001AE2E434000-memory.dmp
memory/3376-623-0x000001AE2E430000-0x000001AE2E434000-memory.dmp
memory/3376-624-0x000001AE28B30000-0x000001AE28B31000-memory.dmp
memory/3376-625-0x000001AE28B30000-0x000001AE28B31000-memory.dmp