26073913009bfe92e3823ec0928fe03e7299eab099db5f35b4ab003097ab2939

Analysis

user interaction
yes
max time kernel
40s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/07/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SourceHubMarket/ImGui DirectX 11 Kiero Hook/imgui/imgui_widgets.vbs
Size 352KB
Sample260724-m5cecaff94
SHA256 26073913009bfe92e3823ec0928fe03e7299eab099db5f35b4ab003097ab2939
MD5 73ae978f412340ddc7818d6b268c495c
SHA1 787bc5fc350bb3561c6998f5ac0ecf6cb54159ce
SHA512 4e9042b202517b755b974a473904efcda758b386283cc3e8c5e5ff5b89e7cc97eb0ef6c8b6a20ab92e17f9a1b1a25c99c20a8361a689889065899cd71cae0c9b
SSDEEP 6144:fc+523KPBKDvZ1mFUIffKuYMi2MMgE7yHXE/Cf:fc+523KPBKDvZ8iMi2MM5yHXE/Cf
TLSH
T15374D4821C2322268933F0285FC76259EB2959373B94D9907A1D635C7F84437C6BDBEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1308	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SourceHubMarket\ImGui DirectX 11 Kiero Hook\imgui\imgui_widgets.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads