1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer_v3500_x64.exe
Size 18.1MB
Sample260802-ralfzsthpe
SHA256 1d5d0dfa7d49213f59f48704305762a936492c57026336a0ff56eafdf5710a48
MD5 18b77efc3df7f3bb6a679bc1992f8e22
SHA1 2dd37623bf004afd71de115107557c58c250fb43
SHA512 3fae9848afc40d2a5a820fa120725bd1fb84cec11ceafa8f9ce115f0dc605b895086ccd7e46bad85c13c6a7beedd014578e21cc43816ef8667af3343204bfa80
SSDEEP 393216:bdD4BJwgJfJAQeqKZhSMOZUa+8CGpaahVnTIZRnyxnubo:2LBk1qshIjppVanYnub
TLSH
T10C17331CA8BE884AD59C37B04A02D059D70E5F3B980B0C6F6BDB663DD41E4538E78B76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence themida trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ioextender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	ioextender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	InterPartHKIAsync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	InterPartHKIAsync.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer_v3500_x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	InterPartHKIAsync.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	ioextender.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3200	powershell.exe
4452	powershell.exe
3200	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	InterPartHKIAsync.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	ioextender.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer_v3500_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer_v3500_x64.exe

Executes dropped EXE 2 IoCs

pid	Process
3064	InterPartHKIAsync.exe
544	ioextender.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4532-8-0x0000000000400000-0x0000000001D90000-memory.dmp	themida
behavioral1/memory/4532-9-0x0000000000400000-0x0000000001D90000-memory.dmp	themida
behavioral1/memory/4532-60-0x0000000000400000-0x0000000001D90000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer_v3500_x64.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	api.ipify.org
16	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4532	Installer_v3500_x64.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1536	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ioextender.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ioextender.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4652	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3200	powershell.exe
3200	powershell.exe
4452	powershell.exe
4452	powershell.exe
3064	InterPartHKIAsync.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe
544	ioextender.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	Installer_v3500_x64.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	3064	InterPartHKIAsync.exe
Token: SeDebugPrivilege	544	ioextender.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3200	4532	Installer_v3500_x64.exe	88
PID 4532 wrote to memory of 4452	4532	Installer_v3500_x64.exe	90
PID 4452 wrote to memory of 3064	4452	powershell.exe	92
PID 3064 wrote to memory of 1480	3064	InterPartHKIAsync.exe	94
PID 3064 wrote to memory of 544	3064	InterPartHKIAsync.exe	96
PID 3064 wrote to memory of 1536	3064	InterPartHKIAsync.exe	97
PID 1536 wrote to memory of 4652	1536	cmd.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer_v3500_x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','PathMarker.vbs','ioextender.exe','InterPartHKIAsync.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe
    "C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "Extended API 0136301" /TR "\"wscript.exe\" //nologo \"C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\PathMarker.vbs\"" /SC MINUTE /MO 20 /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1480
  - - C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\ioextender.exe
      "C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\ioextender.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y738ovhx.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4652

C:\Windows\system32\wscript.exe
"wscript.exe"
1⤵
PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 4211b5503de68413f5605cbeec4a49fb46fbec44c58df95be892f0dc308a39cf
MD5 a15743cd087226baafa094c9aed07dc4
SHA1 2124cf2ac13da80b2e3cd37d3eab477261771423
SHA512 301e82e45c3e190bdbc1316cda1cd735434c5aa873a57322e807c7cf4c23e006e11a7347ebb0f8afed181d3a4d860202cbd6fc721b9970296c7a4b1a367805a7
TLSH
T11E112223F38C8920CC96163A509DAC6172B586CB81AEDF9F7FC0C210A5BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qbjn3323.dcg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qbjn3323.dcg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

y738ovhx.bat

Path C:\Users\Admin\AppData\Local\Temp\y738ovhx.bat
Size 266B
SHA256 5d3dce1d2a3fca3e8a265a793e96e2c04de90571857dea4a1bd52c5a75d568d8
MD5 68ef020e350519dc052d81072a7ba721
SHA1 aca9f6a6790386031513b5be751be48cb9807ea2
SHA512 e5eee308aae4d085d73add37a227585e5ad4f76bc2270ad2a86d0e904341c7a18fb5f6bf3d071b0ce99f76509ad7f581b2bbc284a76d89947c39c6242f7c8dd9
TLSH
T1CED02B05224F07C940013D7207BF10C5397D50D22D842B41674440A962CF004D19A3C5
MD5 SHA1 SHA512 TLSH

Submit Download

InterPartHKIAsync.exe

Path C:\Users\Admin\AppData\Roaming\ExtendedMonitor\TNC000x859\InterPartHKIAsync.exe
Size 409KB
SHA256 640dd656adb4e1e264ed498dbcdcdbc15d8945435c40dd9ce8b0f2b5c208cf5c
MD5 e2b087b6221cdb7b480b49dcc066983c
SHA1 5a57087b370c584d1d682837c1647de1c72bcbad
SHA512 7180e1ae9826408f3f03a4162ad2bd89ecb26957a59dbc7bceb4ef83e7e6c2cfc27d252e850267e699136fd9291e21750154e51bc0e40507e66b85f994fb10a2
SSDEEP 6144:D/bKqHA9t9hmnshI5sr8TtOH+VDbOiAM0tAsx/E4k8dAYwuZ21:DWqWInsUrjbOiAM0asWl
TLSH
T1F1943A17B5898921C1905737C8EB620077F5EA8A72F7EB4D398623C90D033FADD86697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\ExtendedMonitor\install.dat
Size 72B
SHA256 d3f0675a618cd77e9720ffd0eb139d74154af228f580ac058b53f32c74444771
MD5 938df545e8f48e62e88882276a200210
SHA1 a4cd43127a1d9e2a7209378c2e3e15af7cebfc7a
SHA512 899e812a521793ebc3112ecb1627c52e41dc26d84250e9c9cdf2081c83014291ea751c4c4b7fd174642b7acea491b831f3abbc6f1dfcefff69ed18a0aa30412a
TLSH
T101A0220002CEAA0E8200E82303B200CCA0232003BE8C3B088BC0CE0A30C0C00B08830A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3064-45-0x000002D781870000-0x000002D781878000-memory.dmp

Download

memory/3064-42-0x000002D7FF530000-0x000002D7FF59A000-memory.dmp

Download

memory/3200-20-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/3200-25-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/3200-16-0x000001E7D1070000-0x000001E7D1092000-memory.dmp

Download

memory/4532-8-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/4532-0-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/4532-21-0x00007FFFEB8B4000-0x00007FFFEB8B5000-memory.dmp

Download

memory/4532-17-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/4532-10-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/4532-27-0x000000001EDF0000-0x000000001FB92000-memory.dmp

Download

memory/4532-9-0x0000000000400000-0x0000000001D90000-memory.dmp

Download

memory/4532-22-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/4532-5-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/4532-4-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/4532-3-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/4532-2-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/4532-1-0x00007FFFEB8B4000-0x00007FFFEB8B5000-memory.dmp

Download

memory/4532-59-0x00007FFFEB850000-0x00007FFFEBB19000-memory.dmp

Download

memory/4532-60-0x0000000000400000-0x0000000001D90000-memory.dmp

Download