Analysis
- geolocation tags
- max time kernel
900s - max time network
903s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 14:21
General
- Target loader.exe
- Size 5.3MB
- Sample260924-rpc36at19r
- SHA256 6ffe4b8060d232eb4a5a62dd9c3719e987a9863153cc460ad919c98d2458c058
Malware Config
Signatures
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3440-0-0x0000000140492000-0x00000001406CD000-memory.dmp
memory/3440-2-0x00007FFED4340000-0x00007FFED4342000-memory.dmp
memory/3440-1-0x00007FFED4330000-0x00007FFED4332000-memory.dmp
memory/3440-7-0x0000000001FA0000-0x0000000001FA1000-memory.dmp
memory/3440-3-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-8-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-9-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
memory/3440-13-0x0000000001FC0000-0x0000000001FC1000-memory.dmp
memory/3440-12-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
memory/3440-11-0x0000000001FC0000-0x0000000001FC1000-memory.dmp
memory/3440-37-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-49-0x0000000140492000-0x00000001406CD000-memory.dmp
memory/3440-58-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-108-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-149-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-191-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-236-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-272-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-318-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-359-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-400-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-446-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-487-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-533-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-574-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-610-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-656-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-697-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-738-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-774-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-820-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-861-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-907-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-943-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-989-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1030-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1074-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1117-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1158-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1199-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1240-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1286-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1327-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1363-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1404-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1450-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1491-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1537-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1583-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1624-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1660-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1706-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1742-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1784-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1820-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1866-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1902-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1948-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-1989-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2025-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2066-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2107-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2153-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2189-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2235-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2276-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2322-0x0000000140000000-0x0000000140C23000-memory.dmp
memory/3440-2358-0x0000000140000000-0x0000000140C23000-memory.dmp