3c1d9ca5881c3a3280643dffc6c96e14a2e568c9ad3fbada7de61d7dcc93a9f9

Analysis

max time kernel
148s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MALULER.exe
Size 2.2MB
Sample260824-gynadacc49
SHA256 3c1d9ca5881c3a3280643dffc6c96e14a2e568c9ad3fbada7de61d7dcc93a9f9
MD5 426ce2fbf547487b78cf24be3d749b08
SHA1 6648d94be35569bb661eee6e919dcfab8d02e345
SHA512 e351bd3c40941f40539cb9264d0d0f60ce133cd4de2f7185b68cfbd3288b6580c49aa4612db3ef8ac0d9bb87b5bc38161fdd7bd02adbf972ab51c752796536c5
SSDEEP 49152:HElFcXna/H2HQT3RCmHPO7RUOah7r3Br7zDLvQVL0Or/+8ac6gj:AF9RVvO/anX3LIVLVrl3j
TLSH
T1B1B59E4AE6A502E9DC7AC039CC6E665AF87074D68B7047F742518F7B1F223E1A93E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MALU6.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MALU6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MALU6.exe

Loads dropped DLL 1 IoCs

pid	Process
1608	MALU6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1608	MALU6.exe
1608	MALU6.exe
1608	MALU6.exe
1608	MALU6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4824	WMIC.exe
4824	WMIC.exe
4824	WMIC.exe
4824	WMIC.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4824	WMIC.exe
Token: SeSecurityPrivilege	4824	WMIC.exe
Token: SeTakeOwnershipPrivilege	4824	WMIC.exe
Token: SeLoadDriverPrivilege	4824	WMIC.exe
Token: SeSystemProfilePrivilege	4824	WMIC.exe
Token: SeSystemtimePrivilege	4824	WMIC.exe
Token: SeProfSingleProcessPrivilege	4824	WMIC.exe
Token: SeIncBasePriorityPrivilege	4824	WMIC.exe
Token: SeCreatePagefilePrivilege	4824	WMIC.exe
Token: SeBackupPrivilege	4824	WMIC.exe
Token: SeRestorePrivilege	4824	WMIC.exe
Token: SeShutdownPrivilege	4824	WMIC.exe
Token: SeDebugPrivilege	4824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4824	WMIC.exe
Token: SeRemoteShutdownPrivilege	4824	WMIC.exe
Token: SeUndockPrivilege	4824	WMIC.exe
Token: SeManageVolumePrivilege	4824	WMIC.exe
Token: 33	4824	WMIC.exe
Token: 34	4824	WMIC.exe
Token: 35	4824	WMIC.exe
Token: 36	4824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4824	WMIC.exe
Token: SeSecurityPrivilege	4824	WMIC.exe
Token: SeTakeOwnershipPrivilege	4824	WMIC.exe
Token: SeLoadDriverPrivilege	4824	WMIC.exe
Token: SeSystemProfilePrivilege	4824	WMIC.exe
Token: SeSystemtimePrivilege	4824	WMIC.exe
Token: SeProfSingleProcessPrivilege	4824	WMIC.exe
Token: SeIncBasePriorityPrivilege	4824	WMIC.exe
Token: SeCreatePagefilePrivilege	4824	WMIC.exe
Token: SeBackupPrivilege	4824	WMIC.exe
Token: SeRestorePrivilege	4824	WMIC.exe
Token: SeShutdownPrivilege	4824	WMIC.exe
Token: SeDebugPrivilege	4824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4824	WMIC.exe
Token: SeRemoteShutdownPrivilege	4824	WMIC.exe
Token: SeUndockPrivilege	4824	WMIC.exe
Token: SeManageVolumePrivilege	4824	WMIC.exe
Token: 33	4824	WMIC.exe
Token: 34	4824	WMIC.exe
Token: 35	4824	WMIC.exe
Token: 36	4824	WMIC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 1608	5656	MALULER.exe	89
PID 5656 wrote to memory of 1608	5656	MALULER.exe	89
PID 1608 wrote to memory of 4300	1608	MALU6.exe	91
PID 4300 wrote to memory of 4824	4300	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\MALULER.exe
"C:\Users\Admin\AppData\Local\Temp\MALULER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Users\Admin\AppData\Local\Temp\MALU6.exe
  "C:\Users\Admin\AppData\Local\Temp\MALU6.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "wmic useraccount where name='%username%' get sid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name='Admin' get sid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PYG64.DLL

Path C:\Users\Admin\AppData\Local\Temp\PYG64.DLL
Size 1.2MB
SHA256 d02eaf8f65aef28d349863982c63a1942585c4e19997a614b58a6adf835c6eaf
MD5 324606e8bfa5fa605fa2a037f607eb5c
SHA1 704de00fbca7d801367be5454afa42406a0ec288
SHA512 c3007eefe35a30769fcb0f1d90c864e4cb0cb33aa9a415b1d03963233a74c88089815e8cab88ce966c5be826789789eaaeb61d0ed7e8a94dae9b1d13d1a18927
SSDEEP 24576:+RCo/JpVxr349kOtrFIhuUOah7r3Brn7zDwovQP9cW0Or/+zfI33z8Hc6gP:+RCmHPO7RUOah7r3Br7zDLvQVL0Or/+o
TLSH
T12455227A51213AD3D001C4F9F002FAE299A50227DFA846EB59ED5730B9774D219BCEF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-18-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-23-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-5-0x00007FF9BC6A0000-0x00007FF9BCAC1000-memory.dmp

Download

memory/1608-12-0x00007FF99EF60000-0x00007FF99EF70000-memory.dmp

Download

memory/1608-13-0x00007FF9BC6A0000-0x00007FF9BCAC1000-memory.dmp

Download

memory/1608-10-0x00007FF99EF60000-0x00007FF99EF70000-memory.dmp

Download

memory/1608-9-0x00007FF99EF60000-0x00007FF99EF70000-memory.dmp

Download

memory/1608-8-0x00007FF99EF60000-0x00007FF99EF70000-memory.dmp

Download

memory/1608-11-0x00007FF99EF60000-0x00007FF99EF70000-memory.dmp

Download

memory/1608-14-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-15-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-16-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-17-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-35-0x00007FF9BC6A0000-0x00007FF9BCAC1000-memory.dmp

Download

memory/1608-4-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-20-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-22-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-19-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-24-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-21-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-25-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-26-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-29-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-28-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-27-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-31-0x00007FF9BC6A0000-0x00007FF9BCAC1000-memory.dmp

Download

memory/1608-30-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/1608-34-0x0000000000400000-0x00000000014A5000-memory.dmp

Download

memory/5656-0-0x0000000000720000-0x0000000000721000-memory.dmp

Download