2fd7a76367f9ee8ad909c719edddd5e0ef456946177937221bed8c8b3c1b2577

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NebulaLoader.exe
Size 4.0MB
Sample260907-xkwycstdkc
SHA256 2fd7a76367f9ee8ad909c719edddd5e0ef456946177937221bed8c8b3c1b2577
MD5 0cdc49b280de07706020497eed129247
SHA1 c1af8c771174e5265aa0e08ab614c6d9adf6b633
SHA512 01a966354999bd8b231b16c23afff67e4ac80d7effa7cacfde19f389c9e39dfbd6f350da66f6737ecfb13e5f0d92dc9339fda1855e992527742653c2809dba97
SSDEEP 49152:iopBWmEdsQ8EnYvBjX2/VKcdQX/EX6PqtPKvJYogGqfgXjAX8zu3n99llL+XxX9:iMAzl/00X8zuHfk9
TLSH
T18416AE45F7A810E9D036E13CDD93662BE6327845473086DB27E40A2D5FA37E05BBAF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	NebulaLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	NebulaLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	NebulaLoader.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	NebulaLoader.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	NebulaLoader.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NebulaLoader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5536	NebulaLoader.exe
5536	NebulaLoader.exe

C:\Users\Admin\AppData\Local\Temp\NebulaLoader.exe
"C:\Users\Admin\AppData\Local\Temp\NebulaLoader.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare services registry key.
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads