Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VyronLoader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
VyronLoader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target VyronLoader.exe
- Size 8.8MB
- Sample260831-xtfbzaydpg
- SHA256 170351e874f16b0c671842ecc2be731b5050fe2b7cd0b0f9bbaa736f2b431125
- MD5 3a8feb7fc9489f1855e3579bae53b7da
- SHA1 7843263a943e774fe6f57331804f216707a869d0
- SHA512 09bcddbae9f416a3fa934d050c3e6bd0d3da6e68fcf3ca290edbf19320ea8212539d9736ac1c0ebc4b1418c1f6046d2d9e865625258021f14ea3bc749500dae7
- SSDEEP 196608:wh5fXKL+vM7SZdAz+pVhkbfoxam8CrlgXui:wTXKL+v2KIhygX
- TLSH T1069612A3E267439DC29A1C3486929741AEB27C4D1F02C2D773F836264AF75E0CD7A6D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4892 zp8YgJTdus.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4188 VyronLoader.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!= zp8YgJTdus.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!= VyronLoader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4188 VyronLoader.exe 4188 VyronLoader.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe 4892 zp8YgJTdus.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4892 zp8YgJTdus.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4892 zp8YgJTdus.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4188 wrote to memory of 4892 4188 VyronLoader.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\VyronLoader.exe"C:\Users\Admin\AppData\Local\Temp\VyronLoader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\zp8YgJTdus.exeC:\Users\Admin\AppData\Local\Temp\zp8YgJTdus.exe --launched2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4892
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!=
- Size 1KB
- SHA256 b7161c3585b9123eb786686fce37c0d9d9c4278d312506b38a68a33182a08ebc
- MD5 e6a6a8f8debee14d254e438c20668d31
- SHA1 4a3cd36fa747c2d4a1279b57d5fd7d45341707eb
- SHA512 c475096f7b46200801030fcb4ac8d122d9658331e5e7910ec4f28474dcb805862375717c26c103de027f05f535d2afc28c0bc38c41063299ee778ed92e6e1007
- TLSH T15F21F71CEAE985FBCD9301C8E01D0D9FE4617697E780A9437B3AA20C36E3DC68932174
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\':#0'+>9 #!=
- Size 499B
- SHA256 7f49734699e29c0ec49b694d2876fae3af2624011cd7e362548eca8288f108b6
- MD5 45e03c28a69f70c8aefd9cd1a044dbcd
- SHA1 fd2c91f612b2a20d2814105818150874efcb08f1
- SHA512 30767552f3613761ce1ccf747e95f3d111be6394597706cdfb991b3b91f253194414df792b2deb1e10d8d818e32131015261e6a80be4ae63ea6fa5887f8a8fd4
- TLSH T1FAF0AC0CBAF941EB8E8341CED04D4E8FE42137938780E8437B3B964C62D78D69932074
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\zp8YgJTdus.exe
- Size 8.8MB
- SHA256 170351e874f16b0c671842ecc2be731b5050fe2b7cd0b0f9bbaa736f2b431125
- MD5 3a8feb7fc9489f1855e3579bae53b7da
- SHA1 7843263a943e774fe6f57331804f216707a869d0
- SHA512 09bcddbae9f416a3fa934d050c3e6bd0d3da6e68fcf3ca290edbf19320ea8212539d9736ac1c0ebc4b1418c1f6046d2d9e865625258021f14ea3bc749500dae7
- SSDEEP 196608:wh5fXKL+vM7SZdAz+pVhkbfoxam8CrlgXui:wTXKL+v2KIhygX
- TLSH T1069612A3E267439DC29A1C3486929741AEB27C4D1F02C2D773F836264AF75E0CD7A6D1
- MD5 SHA1 SHA512 SSDEEP TLSH