Analysis
- max time kernel
151s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 06:39
General
- Target EmuVGC.exe
- Size 42.6MB
- Sample260729-hev2jsap9s
- SHA256 8123a924a5e89c6eee437a4cfdf4fff31e96872d6393b50fd5e1fac92cf94449
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Downloads MZ/PE file 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EmuVGC.exe"C:\Users\Admin\AppData\Local\Temp\EmuVGC.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\LoaderClient\1707561160eb741d9afd4a7899052b2861b05765ca8d43c29648e090d2f79766.bin"C:\ProgramData\LoaderClient\1707561160eb741d9afd4a7899052b2861b05765ca8d43c29648e090d2f79766.bin" --pipe=ldh-44e600cf660b3f8904eb9da0c12efd2a --ready=ldh-4bf0d8a6b497ac8713c6a528db5ab3b62⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1707561160eb741d9afd4a7899052b2861b05765ca8d43c29648e090d2f79766.bin
c839be4608d3638d3d31af4af8184660493dafc516894a557f51f38c233aadf2.bin
memory/4216-111-0x0000000002930000-0x0000000002931000-memory.dmp
memory/4216-10030-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-126-0x0000000002970000-0x0000000002971000-memory.dmp
memory/4216-118-0x0000000002960000-0x0000000002961000-memory.dmp
memory/4216-113-0x0000000002940000-0x0000000002941000-memory.dmp
memory/4216-115-0x0000000002950000-0x0000000002951000-memory.dmp
memory/4216-0-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-101-0x0000000002920000-0x0000000002921000-memory.dmp
memory/4216-3-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-134-0x000000000ADC0000-0x000000000ADC1000-memory.dmp
memory/4216-132-0x000000000ADB0000-0x000000000ADB1000-memory.dmp
memory/4216-821-0x000000000ADC0000-0x000000000ADC1000-memory.dmp
memory/4216-6282-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-6662-0x000000000ADF0000-0x000000000ADF1000-memory.dmp
memory/4216-8-0x0000000002330000-0x0000000002331000-memory.dmp
memory/4216-9081-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-7-0x0000000002330000-0x0000000002331000-memory.dmp
memory/4216-20346-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-1-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-10977-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-12029-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-19295-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-18244-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-17193-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-16142-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-13094-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-14145-0x0000000140000000-0x0000000141000000-memory.dmp
memory/4216-15091-0x0000000140000000-0x0000000141000000-memory.dmp
memory/8656-12563-0x0000000140000000-0x0000000141000000-memory.dmp
memory/8656-12453-0x0000000140000000-0x0000000141000000-memory.dmp
memory/8656-12242-0x0000000140000000-0x0000000141000000-memory.dmp
memory/8656-12030-0x0000000140000000-0x0000000141000000-memory.dmp
memory/8656-10142-0x0000000140000000-0x0000000141000000-memory.dmp