Analysis
- user interaction
yes - max time kernel
86s - max time network
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 03:45
General
- Target WyvernLoader.exe
- Size 19.0MB
- Sample260824-ea6qpssfma
- SHA256 965af0b687a89e6553e6db4e95a87ac1974bdc6eed048388da371e80601e6c45
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WyvernLoader.exe"C:\Users\Admin\AppData\Local\Temp\WyvernLoader.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6020-0-0x000000014070F000-0x00000001411CB000-memory.dmp
memory/6020-5-0x00007FFFC0080000-0x00007FFFC0082000-memory.dmp
memory/6020-4-0x00007FFFC1CA0000-0x00007FFFC1CA2000-memory.dmp
memory/6020-6-0x00007FFFC0090000-0x00007FFFC0092000-memory.dmp
memory/6020-1-0x00007FFFC1C70000-0x00007FFFC1C72000-memory.dmp
memory/6020-7-0x00007FFFBF880000-0x00007FFFBF882000-memory.dmp
memory/6020-2-0x00007FFFC1C80000-0x00007FFFC1C82000-memory.dmp
memory/6020-3-0x00007FFFC1C90000-0x00007FFFC1C92000-memory.dmp
memory/6020-8-0x00007FFFBF890000-0x00007FFFBF892000-memory.dmp
memory/6020-13-0x0000000140000000-0x00000001424C9000-memory.dmp
memory/6020-9-0x0000000140000000-0x00000001424C9000-memory.dmp
memory/6020-14-0x0000000140000000-0x00000001424C9000-memory.dmp
memory/6020-15-0x0000000002350000-0x0000000002426000-memory.dmp
memory/6020-16-0x000000014070F000-0x00000001411CB000-memory.dmp
memory/6020-17-0x0000000140000000-0x00000001424C9000-memory.dmp
memory/6020-18-0x0000000140000000-0x00000001424C9000-memory.dmp
memory/6020-19-0x0000000002350000-0x0000000002426000-memory.dmp