Analysis
- max time kernel
151s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 16:00
General
- Target Loader.exe
- Size 57.5MB
- Sample261012-tf3csscv3t
- SHA256 6a659a7365a962052a9af8ae1c23b4bab500e09054e05c21e7d5ab7e876cd2d0
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 21 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_48291" dir=out action=block protocol=TCP localport=48291 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_8080" dir=out action=block protocol=TCP localport=8080 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_8888" dir=out action=block protocol=TCP localport=8888 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="PapelShip_Block_8889" dir=out action=block protocol=TCP localport=8889 enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Debugger Evasion
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
4Replay Monitor
Loading Replay Monitor...
Downloads
memory/2212-0-0x00007FFD824B0000-0x00007FFD824B2000-memory.dmp
memory/2212-1-0x00007FFD824C0000-0x00007FFD824C2000-memory.dmp
memory/2212-2-0x00007FFD824D0000-0x00007FFD824D2000-memory.dmp
memory/2212-3-0x00007FFD81840000-0x00007FFD81842000-memory.dmp
memory/2212-4-0x00007FFD81850000-0x00007FFD81852000-memory.dmp
memory/2212-5-0x00007FFD800C0000-0x00007FFD800C2000-memory.dmp
memory/2212-6-0x00007FFD800D0000-0x00007FFD800D2000-memory.dmp
memory/2212-7-0x00007FF6B2FB0000-0x00007FF6B3FB0000-memory.dmp
memory/2212-15-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-26-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-25-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-27-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-28-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-30-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-29-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-31-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-32-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-33-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-34-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-36-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-35-0x0000000180000000-0x0000000181541000-memory.dmp
memory/2212-45-0x00000233B8E30000-0x00000233B8ED8000-memory.dmp