3f3a4e88a65f4149288dee64ed119910c16b8f3904e42bfa246cc330cd6a1efd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader (1).exe
Size 8.5MB
Sample260729-sa3wpsab59
SHA256 3f3a4e88a65f4149288dee64ed119910c16b8f3904e42bfa246cc330cd6a1efd
MD5 410ea52989e9cd5beaee6927585ccbd9
SHA1 e2f348a998ae040a174e6f854ff0cb326c40ed0e
SHA512 fbb57e9bfd4380cb9630b330d641985861dd140150be5e6aa7aa4e5bfd6ad616cef57e1f5ef79c9b84eab429e1f9ae9b5819f63cefc15d3fb4e42d464ecfc375
SSDEEP 196608:Np/GP6XLgYNoV9a94E2y92TIJwNJxW4mTG2ODeyuXiB/g:N5bgbfoV2y92TEwNJxIG7ayB/g
TLSH
T154963368A4D2A7CEC4D1ADF1B7F0E5543B140F35EB98E5807042A02F9ACFE6590967D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Loader (1).exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Loader (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Loader (1).exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4264-0-0x0000000140000000-0x000000014166F000-memory.dmp	themida
behavioral2/memory/4264-2-0x0000000140000000-0x000000014166F000-memory.dmp	themida
behavioral2/memory/4264-1-0x0000000140000000-0x000000014166F000-memory.dmp	themida
behavioral2/memory/4264-4-0x0000000140000000-0x000000014166F000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Loader (1).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe
4264	Loader (1).exe

C:\Users\Admin\AppData\Local\Temp\Loader (1).exe
"C:\Users\Admin\AppData\Local\Temp\Loader (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4264-0-0x0000000140000000-0x000000014166F000-memory.dmp

Download

memory/4264-2-0x0000000140000000-0x000000014166F000-memory.dmp

Download

memory/4264-1-0x0000000140000000-0x000000014166F000-memory.dmp

Download

memory/4264-4-0x0000000140000000-0x000000014166F000-memory.dmp

Download