Analysis
- user interaction
yes - max time kernel
20s - max time network
18s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 16:27
General
- Target CircuitLordVRModInstaller.exe
- Size 337KB
- Sample261002-tyjcmseb64
- SHA256 9bd116ff40fd9e275518782b552e0f2f718b0c36882d15e00078472412001bbe
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CircuitLordVRModInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CircuitLordVRModInstaller.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4500-0-0x0000018B47AA0000-0x0000018B47AFA000-memory.dmp
memory/4500-1-0x0000018B63020000-0x0000018B63030000-memory.dmp
memory/4500-2-0x0000018B63AE0000-0x0000018B63B9A000-memory.dmp
memory/4500-3-0x0000018B61FA0000-0x0000018B61FBC000-memory.dmp
memory/4500-4-0x0000018B63020000-0x0000018B63030000-memory.dmp
memory/4500-6-0x0000018B65ED0000-0x0000018B65EDE000-memory.dmp
memory/4500-5-0x0000018B65F10000-0x0000018B65F48000-memory.dmp
memory/4500-7-0x0000018B65F50000-0x0000018B65F62000-memory.dmp
memory/4500-8-0x0000018B665E0000-0x0000018B6661C000-memory.dmp
memory/4500-9-0x0000018B63020000-0x0000018B63030000-memory.dmp
memory/4500-11-0x0000018B678D0000-0x0000018B678D8000-memory.dmp
memory/4500-12-0x0000018B63020000-0x0000018B63030000-memory.dmp
memory/4500-13-0x0000018B63020000-0x0000018B63030000-memory.dmp
memory/4500-14-0x0000018B63020000-0x0000018B63030000-memory.dmp