e9b59e3f48f22f1ef2cd58aa7c4c4ccae098bdf615ac990999108b893b9a1a05

Resubmissions

03/08/2026, 04:37

260803-e89j9aydkg

03/08/2026, 04:35

260803-e7485sca759

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build.exe
Size 9.2MB
Sample260803-e7485sca75
SHA256 e9b59e3f48f22f1ef2cd58aa7c4c4ccae098bdf615ac990999108b893b9a1a05
MD5 46da373fa8388399a688ac4b9782e921
SHA1 2b2de8914ac17e4ae3e3d8e017691e3b4c6324a9
SHA512 08e368fa47d8f4830667b272748c94793b6224a223a05920b5ab5722634a60c0fdf281b9728895bbb5dec01fae7ce3738986f2055040069bb5f98279e94dcc6c
SSDEEP 196608:1+1G7bsk0EKkgmXqdQQ8aGkc47Ram7U0UBC:1+1Obsk0EKkLXc8aGkc47Ram7AC
TLSH
T1BCA68C15E77800D8E4AAC1B9C7465157D7B1784A03B0ABDF1A90AEF62F27AE41F3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	build.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	build.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
312	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	build.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	build.exe
4656	build.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4768	4656	build.exe	85
PID 4768 wrote to memory of 312	4768	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\System32\cmd.exe
  /c timeout /t 2 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\build.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads