Analysis
- user interaction
yes - max time kernel
84s - max time network
62s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 23:27
General
- Target EMU.exe
- Size 42.6MB
- Sample260730-3frqqssthx
- SHA256 8123a924a5e89c6eee437a4cfdf4fff31e96872d6393b50fd5e1fac92cf94449
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Downloads MZ/PE file 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EMU.exe"C:\Users\Admin\AppData\Local\Temp\EMU.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\LoaderClient\1707561160eb741d9afd4a7899052b2861b05765ca8d43c29648e090d2f79766.bin"C:\ProgramData\LoaderClient\1707561160eb741d9afd4a7899052b2861b05765ca8d43c29648e090d2f79766.bin" --pipe=ldh-d842b045ddc5fae762bfdbc6a4e2b4cf --ready=ldh-4faeaf9fcfbeea441721e189ec6e18bf2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1707561160eb741d9afd4a7899052b2861b05765ca8d43c29648e090d2f79766.bin
c839be4608d3638d3d31af4af8184660493dafc516894a557f51f38c233aadf2.bin
memory/2356-11301-0x0000000140000000-0x0000000141000000-memory.dmp
memory/2356-11191-0x0000000140000000-0x0000000141000000-memory.dmp
memory/2356-10873-0x0000000140000000-0x0000000141000000-memory.dmp
memory/2356-9400-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-8-0x0000000002980000-0x0000000002981000-memory.dmp
memory/5732-101-0x0000000002990000-0x0000000002991000-memory.dmp
memory/5732-7-0x0000000002980000-0x0000000002981000-memory.dmp
memory/5732-118-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/5732-126-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/5732-134-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/5732-132-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/5732-837-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/5732-6587-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-6662-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/5732-111-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/5732-0-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-9189-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-115-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/5732-10031-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-113-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/5732-10980-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-3-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-2-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-11937-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-13036-0x0000000140000000-0x0000000141000000-memory.dmp
memory/5732-14144-0x0000000140000000-0x0000000141000000-memory.dmp