ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4J8576A0E8V3.exe
Size 2.6MB
Sample260728-w448easfna
SHA256 ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81
MD5 1f7aa3a0425d198ff16df8e903d56aac
SHA1 cc514536ad84fca256cb1e5f7255f18a6809e6d0
SHA512 0a8dd68b65a6da654e457f5d73fea1a6071c8a5d85bd984ca99a52c7a5a9e682a9e7e27b2a45255b1834229284b56c83e307cd6afc23ccf7d55a3a4f93bcc3f6
SSDEEP 49152:i795t5WNFN8llgHKWmBNzD+CnySA88RvCEOV70eM1VM6Wys:i795vWNP2lsV+f+CnW86CEOVEDjWy
TLSH
T16DC5029F31E62069F9E83330D47577B60ED2BD8A78E49E8CC694552C7E0D02D498E2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	4J8576A0E8V3.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	4J8576A0E8V3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4272 set thread context of 5036	4272	4J8576A0E8V3.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4272	4J8576A0E8V3.exe
4272	4J8576A0E8V3.exe
4272	4J8576A0E8V3.exe
4272	4J8576A0E8V3.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 5036	4272	4J8576A0E8V3.exe	89
PID 4272 wrote to memory of 5036	4272	4J8576A0E8V3.exe	89

C:\Users\Admin\AppData\Local\Temp\4J8576A0E8V3.exe
"C:\Users\Admin\AppData\Local\Temp\4J8576A0E8V3.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe"
  2⤵
  PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4272-0-0x00007FFAD7200000-0x00007FFAD7463000-memory.dmp

Download

memory/4272-2-0x00007FF619C40000-0x00007FF619ED9000-memory.dmp

Download

memory/5036-1-0x0000000140000000-0x000000014028D000-memory.dmp

Download