Analysis
- user interaction
yes - max time kernel
29s - max time network
31s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
24/10/2026, 04:35
General
- Target TOS_SHIT_OLD/TOS.exe
- Size 26.5MB
- Sample261024-e7xjashx5r
- SHA256 f5518b1c1de5c7d9448cb0c33c0c0ab70b6139710615bd3d930c9ceef557bb04
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 12 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TOS_SHIT_OLD\TOS.exe"C:\Users\Admin\AppData\Local\Temp\TOS_SHIT_OLD\TOS.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TOS_b2366d36a29678e5\TOSGui.exe"C:\Users\Admin\AppData\Local\Temp\TOS_b2366d36a29678e5\TOSGui.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Qt6Core.dll
Qt6Gui.dll
Qt6Svg.dll
Qt6Widgets.dll
TOSGui.exe
qsvgicon.dll
qgif.dll
qico.dll
qjpeg.dll
qsvg.dll
qwindows.dll
qmodernwindowsstyle.dll
memory/5036-32-0x000001F6B1890000-0x000001F6B18A0000-memory.dmp
memory/5036-29-0x00007FFEB47B0000-0x00007FFEB4DF9000-memory.dmp
memory/5036-46-0x000001F6B1ED0000-0x000001F6B2076000-memory.dmp
memory/5036-48-0x000001F6B1ED0000-0x000001F6B2076000-memory.dmp