Analysis
- max time kernel
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Terenax Private Loader (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
Terenax Private Loader (1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
120 seconds
General
- Target Terenax Private Loader (1).exe
- Size 1.1MB
- Sample260804-ve7rkaszev
- SHA256 80aeec314070f1531bb5a568fd64f70bb36e3b22593bfe7e992f250f786002a5
- MD5 9aa6a1cbb87dca4922fa90775d092036
- SHA1 34ed10ffd13ef86bbd5e8f3690406349813d0f30
- SHA512 443fbc431696cf4618ba58e218049d70afc60a223a82261410ed2c6394d9373f68c6f9821d42e4c0e6dd26e0752132ff9d8f4134598d5b5e5e1f6aa7ea86e911
- SSDEEP 12288:7zmqwHC39mo9gkBoTLnmcBaEkEymPUrgpnsxBhYEQFViar3Z4eQ0P35qHjdf2MzJ:GqPtmLkBoTLDByEytc6BzKQ0xwzRW4
- TLSH T13B357C01BBB802A9E2FF9B39D8710506C776FC4A9725EBCF1A4845AD1D633909D31B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Terenax Private Loader (1).exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Terenax Private Loader (1).exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Terenax Private Loader (1).exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1072 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe 1820 Terenax Private Loader (1).exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1820 wrote to memory of 1072 1820 Terenax Private Loader (1).exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Terenax Private Loader (1).exe"C:\Users\Admin\AppData\Local\Temp\Terenax Private Loader (1).exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:1072
-