Analysis
- user interaction
yes - max time kernel
330s - max time network
290s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VyronLoader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
VyronLoader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target VyronLoader.exe
- Size 8.8MB
- Sample260831-xtfbzaydpg
- SHA256 170351e874f16b0c671842ecc2be731b5050fe2b7cd0b0f9bbaa736f2b431125
- MD5 3a8feb7fc9489f1855e3579bae53b7da
- SHA1 7843263a943e774fe6f57331804f216707a869d0
- SHA512 09bcddbae9f416a3fa934d050c3e6bd0d3da6e68fcf3ca290edbf19320ea8212539d9736ac1c0ebc4b1418c1f6046d2d9e865625258021f14ea3bc749500dae7
- SSDEEP 196608:wh5fXKL+vM7SZdAz+pVhkbfoxam8CrlgXui:wTXKL+v2KIhygX
- TLSH T1069612A3E267439DC29A1C3486929741AEB27C4D1F02C2D773F836264AF75E0CD7A6D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5084 7zfAZmnJJ2.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2852 VyronLoader.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!= VyronLoader.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!= 7zfAZmnJJ2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 VyronLoader.exe 2852 VyronLoader.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe 5084 7zfAZmnJJ2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5084 7zfAZmnJJ2.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5084 7zfAZmnJJ2.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2852 wrote to memory of 5084 2852 VyronLoader.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\VyronLoader.exe"C:\Users\Admin\AppData\Local\Temp\VyronLoader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7zfAZmnJJ2.exeC:\Users\Admin\AppData\Local\Temp\7zfAZmnJJ2.exe --launched2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5084
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!=
- Size 453B
- SHA256 5915354b47472a36ea0518d05a8ff1566959560874eeba6f6cc9924b981b6d58
- MD5 c20b48276dce54c79e38a50afa82cf07
- SHA1 4d439222ddf3f9174f83b35080216d072806ab2c
- SHA512 de4ad5fe6d76bef6af104c7163a9f80679abd268b743246a29494ab19447b315aef77c64ffc3b4d99d285f954c74a791baecc7483d6361cf83795e8c8c9b0472
- TLSH T14EF0C04CAAE501FB8E8342CDD08D4E8FD42137838340E8417B3A964C62975C5993307C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!=
- Size 909B
- SHA256 1be901ed3e5cc14a888fb1186fdbc1694d56401837c82e04e558c9db810fef3d
- MD5 58d4913fb85595204aaf069a50ff4870
- SHA1 1a292de18fdfd65c2657de7a338a5ce9f2177b3b
- SHA512 d0d428dd6a65593c0934f80c6cbad9960a13ebfe30197b22d80f12795efa697873fd8ea0788a7a2382569bc8d7dc6ccdbe971bda9c84e9cc10da386941197895
- TLSH T1EE11039CAAE941FB8D9302C9D09D0D8FE4613A979780D8417B3BD60C66D79C5993207C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!=
- Size 1KB
- SHA256 08f38a8dabc4c57dc7035acb1df6a74012b13e68a82b157737d5cd86c279cdd2
- MD5 a0df4e4df236d2f176441c13100fa707
- SHA1 2b994acf6dd1635a8beadb99be42e94236b5548b
- SHA512 10beea8dd3dcaf8876b87355ce17357b5af7d2f890ddc89ca419582622fa9804bb0ab9931e941c66aebd909f4f5c3a9ef03b1dd3cbbd429e26a44575436ba08d
- TLSH T16721F19CAAE984FBCD9302C9D08D0D8FE4717A979780E9427B3A960C76D39C58932078
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zfAZmnJJ2.exe
- Size 8.8MB
- SHA256 170351e874f16b0c671842ecc2be731b5050fe2b7cd0b0f9bbaa736f2b431125
- MD5 3a8feb7fc9489f1855e3579bae53b7da
- SHA1 7843263a943e774fe6f57331804f216707a869d0
- SHA512 09bcddbae9f416a3fa934d050c3e6bd0d3da6e68fcf3ca290edbf19320ea8212539d9736ac1c0ebc4b1418c1f6046d2d9e865625258021f14ea3bc749500dae7
- SSDEEP 196608:wh5fXKL+vM7SZdAz+pVhkbfoxam8CrlgXui:wTXKL+v2KIhygX
- TLSH T1069612A3E267439DC29A1C3486929741AEB27C4D1F02C2D773F836264AF75E0CD7A6D1
- MD5 SHA1 SHA512 SSDEEP TLSH