9d548e21bc4f23549f7dd006818d521e989d1117948a7b0c844b27d7c9b85cbf

Analysis

user interaction
yes
max time kernel
34s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
beacon.exe
Size 496KB
Sample260801-sdmnws1zdt
SHA256 9d548e21bc4f23549f7dd006818d521e989d1117948a7b0c844b27d7c9b85cbf
MD5 cd3c4f73b884289e1c6933dd1800bb8a
SHA1 9163e534fc868538cc0ac38e73e33b541875607e
SHA512 7de49c745baa35171e900fc52a0ab3bd55e9b20bb14623bf4187f5b0ad24a013ce47ae85e6d697312b3a6b7bae75809bacc8d4d469a4bb20b50405a6f7f16b7b
SSDEEP 6144:Oz+g7419CHo+K5eTs0ZZ8Npz4NetninSFtIOcKDJebbhxjZSce7:OzL6X+K5eV8NpMNe0nSFtReblxM
TLSH
T10DB46C6A9A5403B9E0A7C178CE5A4802F7727C4A03B1AEDF07E449725E276D19F3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	beacon.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	beacon.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	beacon.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	beacon.exe

C:\Users\Admin\AppData\Local\Temp\beacon.exe
"C:\Users\Admin\AppData\Local\Temp\beacon.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads