Analysis
- user interaction
yes - max time kernel
33s - max time network
35s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
25/09/2026, 15:26
General
- Target BAMParser.exe
- Size 5.8MB
- Sample260925-svkkvsfb85
- SHA256 227e0b89a5f95e13376a42060d38facab9444fbd368fa7dd4f9ed17a4e8fe6b6
Score
7/10
Malware Config
Signatures
- VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BAMParser.exe"C:\Users\Admin\AppData\Local\Temp\BAMParser.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\BAMParser.exe"C:\Users\Admin\AppData\Local\Temp\BAMParser.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\BAMParser.exe"C:\Users\Admin\AppData\Local\Temp\BAMParser.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2812-8-0x00007FF712400000-0x00007FF712E51000-memory.dmp
memory/2812-10-0x00007FF712400000-0x00007FF712E51000-memory.dmp
memory/2812-14-0x00007FF712400000-0x00007FF712E51000-memory.dmp
memory/2872-16-0x00007FF712400000-0x00007FF712E51000-memory.dmp
memory/4816-0-0x00007FF712516000-0x00007FF71288B000-memory.dmp
memory/4816-1-0x00007FFC5EAD0000-0x00007FFC5EAD2000-memory.dmp
memory/4816-2-0x00007FF712400000-0x00007FF712E51000-memory.dmp
memory/4816-6-0x00007FF712516000-0x00007FF71288B000-memory.dmp
memory/4816-7-0x00007FF712400000-0x00007FF712E51000-memory.dmp