Analysis
- user interaction
yes - max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hibro.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
hibro.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target hibro.dll
- Size 1.6MB
- Sample260809-tnstbst1bw
- SHA256 1b7c135173aad8e101c7b332b691714c4642a3dfabc2eff13257e35699a74a5d
- MD5 77711bb52ed632863a1d4ab4f94fffe5
- SHA1 e4f4944b377b0b69457c58e94fa855c8e649e530
- SHA512 c591c1845f32b09979ee126287f6293d6cb3c5dc71e99205691856d82c3c28c207a3a97638cac656501d1f693b897b7bd809101a1dbbb20c34f782254a25972f
- SSDEEP 24576:SfJq9ZIRU9llfrfsFj4SqrgwaZsb+X6UFIoZueoVr:S6ZIRU9lRsJ4Ewaeb+X6O
- TLSH T1CD751917E6A295ECC53BD0748667A732FD70B85E41347E2E1B94DB311F20E60A72EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 1184 rundll32.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1184 rundll32.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe 1184 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\hibro.dll,#11⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Badlisted process makes network request
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1184