0d7c4cc5f33b019c475de553b0c239c5b95b7936a987b14cdaf288327103dec3

Resubmissions

06/08/2026, 09:21

260806-lbc84ssvbz9

06/08/2026, 09:03

260806-kz6pwsgn8s9

Analysis

user interaction
yes
max time kernel
32s
max time network
63s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
06/08/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Neverlose.exe
Size 51.3MB
Sample260806-lbc84ssvbz
SHA256 0d7c4cc5f33b019c475de553b0c239c5b95b7936a987b14cdaf288327103dec3
MD5 5455aa59a4d336fd97895da555910912
SHA1 813b00a20546771a7a441ba827e84ee7b202038a
SHA512 78e272e182337603dc6c94ea4ca62883ac9b56c75ebb29167310015b3e9e02337257ee8bad2c5818bd24b6d9268d4306d35e4992d110b415a782d939c3fa3efc
SSDEEP 786432:Yxf3x54Z0IaHFFiCoaO1+cfjd2Le22SxiMhWMJqHukxZ8tGzFrSNQeMIHcQA/t8:mfB54L2nd3cfQLIShMuQzFro5cQA/t8
TLSH
T170C73310610444C8DCD8BA37C0BF2C99D6510CFCA26DC66988ABF7D6D6F205F76A78E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Neverlose.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Neverlose.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Neverlose.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1192-0-0x0000000000400000-0x0000000006095000-memory.dmp	themida
behavioral1/memory/1192-1-0x0000000000400000-0x0000000006095000-memory.dmp	themida
behavioral1/memory/1192-2-0x0000000000400000-0x0000000006095000-memory.dmp	themida
behavioral1/memory/1192-3-0x0000000000400000-0x0000000006095000-memory.dmp	themida
behavioral1/memory/1192-4-0x0000000000400000-0x0000000006095000-memory.dmp	themida
behavioral1/memory/1192-6-0x0000000000400000-0x0000000006095000-memory.dmp	themida
behavioral1/memory/1192-134-0x0000000000400000-0x0000000006095000-memory.dmp	themida
behavioral1/memory/1192-135-0x0000000000400000-0x0000000006095000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Neverlose.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1192	Neverlose.exe
1192	Neverlose.exe
1192	Neverlose.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neverlose.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5356	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1192	Neverlose.exe
1192	Neverlose.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 3572	3396	chrome.exe	93
PID 3396 wrote to memory of 3584	3396	chrome.exe	95
PID 3396 wrote to memory of 3584	3396	chrome.exe	95

C:\Users\Admin\AppData\Local\Temp\Neverlose.exe
"C:\Users\Admin\AppData\Local\Temp\Neverlose.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff83181c728,0x7ff83181c734,0x7ff83181c740
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,17061478805316523827,16237818580540425404,262144 --field-trial-handle=2028,i,4648529034092982199,18062171221323296,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,16598386819327528792,4399918723649160436,524288 --field-trial-handle=2028,i,4648529034092982199,18062171221323296,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,2422096924751912006,6156445736352280387,524288 --field-trial-handle=2028,i,4648529034092982199,18062171221323296,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,3833442027143925793,6709239675998530389,2097152 --field-trial-handle=2028,i,4648529034092982199,18062171221323296,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,7319745341013621801,5940816300445217841,2097152 --field-trial-handle=2028,i,4648529034092982199,18062171221323296,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,7806688312060630708,4284215042756922951,2097152 --field-trial-handle=2028,i,4648529034092982199,18062171221323296,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4600,i,6366350754807123264,13555196770610031671,2097152 --field-trial-handle=2028,i,4648529034092982199,18062171221323296,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e4c004f7c7d80868d5d67472136b082b1a6d1cf0d1210323427592611ed6f924
MD5 256314781bb13f167c78fd5f35c6470e
SHA1 2e5aa3bde3a0d51961d40ac6e076ec3764d2ceee
SHA512 8865767cd8c3c000993f6e88ce54d1946c766f202ab172732d7dc91db0d863c6dad2096f8d54c24fda655623623a05ee50f58e40642f6b701dd3df798e36ab0e
TLSH
T1AD316BF793A4997D861092F4AA156E2FCF690924132C7CA688D46E2B47E2972D14068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 ae3bf3ee52a6aac730562bebb26686c203348bcc4c7a111749c3b09d188679c3
MD5 f3b1e8d2f058481b3500db7aac67de65
SHA1 151bb1168a67d576fcf7f2ad41fc3f59c52bce57
SHA512 cb3a652dbe63183d3f4d7b3e010a4d097c91d0c3abc5abbee8350404078f168608d1266cd566f352d912227a546d2bd5c9be6529b5bc7b785e2beb3074db4b96
TLSH
T10FF0C067E779B01700B902BA2E087C0559B6A430068119F0CFAB526DE0810F31B02457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a06f90f9ee67cf3dbf959528911f82fc22297b0c3ed4e0b8cc6c2b7e50c9a1c0
MD5 aec4a8f10922e14aff340a0a9eec9104
SHA1 c886f84c0700c34105548438db2900c43e75e532
SHA512 79984af0c31c35986a1fda99751dbe78bd14ab4a2d121e9b63465e304fb2aab8965b7c7119d94b9dd1559bb37a0ca2965b28868dfc982684b38bd64acff7c333
SSDEEP 192:PR6Wio09umDFYv7XpAPRp2k9fHsb+WNnJe0RxPyIsnAUge:PR6WDcusELUXPFwU0fe
TLSH
T1E432841EB914653BACDBD22EF9627753E3F5103624902E84EAFC9A2C15EB5CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 88441f7725ed5685a2b1d5ef5037fb37b54904dd97a8a2e234382b55065b22e8
MD5 c29b41f992c4ca55f64012533f9da5d4
SHA1 d5a8a53295507f58299f13453395eb33e04f9055
SHA512 0b1196d764e78b4d4c7d2aba28cad794876b0671219aef38c499341d98770405f20546863e3a2394172f1f8fb23b09b0b7356fa4b03378afcb84bc1a7b60ae15
SSDEEP 384:eojKB7KxkXqKf/pUZNCgVLH2Hfgslmc7pLuLcSjYZXODKZ+ErU3n6HGY3Wobe:ecKB7KxkXqKf/pUZNCgVLH2Hfgscc7pg
TLSH
T14C7207777C489A370F94CACCD8277F4FADB5025B66E9886486FA482503D5ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 faafc2b410b6e0f2b653c2354c8b1e127ff3bcf4d779ffe5f362981678276284
MD5 b4f3115a82d04da081efe18eb8b2442e
SHA1 46027cb41566dea0352b1fcb8aa7d7ba0eada495
SHA512 fbde7401d9a762e109641780da8918943fa304b026bf5b7d6f303fa53fa0e00239dfa270443782ec0b9dfea623e92ed37c6fc78d4a120127f782da816eb4ee22
TLSH
T154B0120088027101C04202F4211218D875849F109D1D1B0383E4793288294A59014050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8af.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a8af.TMP
Size 96B
SHA256 720c05c0f605e5ae59a1150804bd81c603240df90c39930531283f6de7024c9d
MD5 708ec4f3647f2785e1f0962a347327c9
SHA1 efe336478e0d0494e0c6a4a0e19e242eee3fa36e
SHA512 b031354be4b9876f43dcade8091a17fcb057a51fcd992e9e68ba56106f7c340e363d44e65b1afaaa76cf2d89a7408646d14994500e7e6f67402722157a8968a6
TLSH
T1D5B02220C0022302C00203B0388A80C8F020CFA2CB030202A2E00A22CCACA200038AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6b20bfb5fcafbd40297044dd0a39e166ed2cbc56894c7c4a30e0680b84528f48
MD5 daf2f2c4c07a2122b89d278e52e32efc
SHA1 ba6d1f6803d5b56f4064aa7339cc67d654625493
SHA512 0415c9f625605a98e4d9c7022280d3c3b5065c4a9b22fbfc1e5e870abd257d3a59a8e2e868cfc24eb8b741a3fb54a82766ff13b5dd1b723967238c54a15b64e4
SSDEEP 3072:vGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:+m7Rkm1tYpBeh2BAon
TLSH
T171C312375D75A83759B5B75EB04E0B1F1EF24AA7C920DE92C8D86A0433EA7CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 434a69dc3ee944a13918d682de7a057cd7bbbe6886d76a83cb60145437fc2e1b
MD5 dc675cb6f6d288a65e3a4667a4310ebb
SHA1 1970de65eb10508cf5a3eaa5d6a44e820fcddcb3
SHA512 7af61cb577f56fbc6816784d249abcae5ba79862d4a869527f69e86462145c76390557b8d67b550f1c8cca4718534847a19d09914d66c20256c21fbfe8f97890
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMC:km7Rkm1tYpBeh2BAoC
TLSH
T162C312375D71E93B6975A71EB48E0F1F1EF14AB2C920DE52C8D86A0437EA7CC0A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1192-6-0x0000000000400000-0x0000000006095000-memory.dmp

Download

memory/1192-5-0x00000000051C8000-0x00000000051C9000-memory.dmp

Download

memory/1192-4-0x0000000000400000-0x0000000006095000-memory.dmp

Download

memory/1192-3-0x0000000000400000-0x0000000006095000-memory.dmp

Download

memory/1192-0-0x0000000000400000-0x0000000006095000-memory.dmp

Download

memory/1192-2-0x0000000000400000-0x0000000006095000-memory.dmp

Download

memory/1192-1-0x0000000000400000-0x0000000006095000-memory.dmp

Download

memory/1192-134-0x0000000000400000-0x0000000006095000-memory.dmp

Download

memory/1192-135-0x0000000000400000-0x0000000006095000-memory.dmp

Download