c0bc406cdec8e4db45bf0f7c67e1335022f2b7ed2c69b8aae0b31591f19daf8c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0bc406cdec8e4db45bf0f7c67e1335022f2b7ed2c69b8aae0b31591f19daf8c.exe
Size 4.1MB
Sample261027-e3kc6sys5r
SHA256 c0bc406cdec8e4db45bf0f7c67e1335022f2b7ed2c69b8aae0b31591f19daf8c
MD5 d986fb7f33aa13fefd6cb004d60121af
SHA1 92c04c9653c230213b04a6e6a08c1551ed85279e
SHA512 2e73013b34e8310524858f43cc032e2d75016bd0e7492ade563bc30df6ebfada191c6628d2257e0442dd2893315e068c795a7f01f7deb24ddc7c7866035ff974
SSDEEP 98304:YbbNExnSc893GPC57UnzxuUbdjFOhAM1k//GjMrgb9X9v:8N8U3v5ozxuQrotO//GYy
TLSH
T18216233E6395EB8BC61B67784212F1EE95124EAD3479C9106E35FD973932BF40F118A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	S1Mini.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	S1Mini.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	S1Mini.exe

Executes dropped EXE 1 IoCs

pid	Process
3508	S1Mini.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000500000001b7fb-10.dat	themida
behavioral2/memory/3508-19-0x0000000140000000-0x0000000140A2F000-memory.dmp	themida
behavioral2/memory/3508-23-0x0000000140000000-0x0000000140A2F000-memory.dmp	themida
behavioral2/memory/3508-22-0x0000000140000000-0x0000000140A2F000-memory.dmp	themida
behavioral2/memory/3508-20-0x0000000140000000-0x0000000140A2F000-memory.dmp	themida
behavioral2/memory/3508-21-0x0000000140000000-0x0000000140A2F000-memory.dmp	themida
behavioral2/memory/3508-198-0x0000000140000000-0x0000000140A2F000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	S1Mini.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3508	S1Mini.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Colors	S1Mini.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	S1Mini.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	S1Mini.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	S1Mini.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	S1Mini.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	S1Mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	S1Mini.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	S1Mini.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	S1Mini.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	S1Mini.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	S1Mini.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3508	S1Mini.exe
3508	S1Mini.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3508	S1Mini.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3508	S1Mini.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3508	4256	c0bc406cdec8e4db45bf0f7c67e1335022f2b7ed2c69b8aae0b31591f19daf8c.exe	88

C:\Users\Admin\AppData\Local\Temp\c0bc406cdec8e4db45bf0f7c67e1335022f2b7ed2c69b8aae0b31591f19daf8c.exe
"C:\Users\Admin\AppData\Local\Temp\c0bc406cdec8e4db45bf0f7c67e1335022f2b7ed2c69b8aae0b31591f19daf8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\XJStudio_5ef36bbc\S1Mini.exe
  "C:\Users\Admin\AppData\Local\Temp\XJStudio_5ef36bbc\S1Mini.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S1Mini.exe

Path C:\Users\Admin\AppData\Local\Temp\XJStudio_5ef36bbc\S1Mini.exe
Size 3.9MB
SHA256 d391b7598ac757acae44295ff207c6d01f8ee3c59b0932a091391919d00564c9
MD5 6a3f0ef127c394e00991608939c74f59
SHA1 19b6a8431a5e7a6c9a10b1b3a956c933e1f395ab
SHA512 a2075a914a9f85ad2a936b5e0c95b4a8f2dcb29c63d5a32bbc69179930e7ca48ade57749ecea2330f2eb78292b6abf41dafd323bf5907cda3d5b7204ff40a81e
SSDEEP 98304:ubbNExnSc893GPC57UnzxuUbdjFOhAM1k//GjMrgb9X9vJ:WN8U3v5ozxuQrotO//GYyD
TLSH
T1F016333A6251AB8FC61F26748212F1DF61534E693475C924AE39FE973936FF90F018A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Local\Temp\XJStudio_5ef36bbc\launcher.log
Size 477B
SHA256 e312c179537ffd913c4709377c456fe0cafc84b60a1b5168b3fe7e9dd580536b
MD5 1cfb10ff6f8c4438a35aedcc7c6ec767
SHA1 9c161e95e798d02f5f5708721ac60b8b5048ba3c
SHA512 f5e183c42d28dd7aa0c77798d612d9fb69fa7591650560d03dafdf7c72d0990a752ab279e4d04254321a5de3a63b7f5ed0d2c28f1265fcb2bfae0ee9aae04916
TLSH
T15AF037907B568BC364F19158D5DF9AC308EE42AB141F44F5FE12C50D201ECFE1EAD429
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Local\Temp\XJStudio_5ef36bbc\launcher.log
Size 916B
SHA256 ac764fdecf08d15421defc619bde764c18df698e58bf1f89c6689127afbe0db1
MD5 a6610fbf66fd8be5398f77d6808096b5
SHA1 7e117ef2ce55425ec1ae6a14df8551f9fa05f74e
SHA512 3c236b52fcfd46e03db01668cb652a26df32b488b1ea8cb7c529406ae944970ddd3fe1bb2368e9007992ce3380339b57c0ebaf4388738481788eca778f4ae2bf
TLSH
T18F11CAD4B7198EC7BDA0D05896CBC682049E876A151F66F0BA439049214BDEE0EEC434
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Local\Temp\XJStudio_5ef36bbc\launcher.log
Size 1KB
SHA256 335e3f7e17bd7150aac7b31bfeadfe75a1e66a7e8d4fd1fc36a92666d72c75b2
MD5 50cb9fb08c6916dcc2c5039180e2b53e
SHA1 155f8ddb1d51dc52d4ceec15297fbc413b9373f1
SHA512 fa5c92a47acd167f3e5da60b8aa75edec3c3d003238479016f6bc82480e8c5503ac03cff23f270f95caf4ef7a7b0dbfd411d8d5208c29946e4d78a97bf50ecec
TLSH
T18231C5D4B33F8CE7E8F0E09481A7CB12145A41B612FE7DB9575BD109B50EDBB08B9560
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Local\Temp\XJStudio_5ef36bbc\launcher.log
Size 4KB
SHA256 d498f3a0a79cd1f852cd6a1e847aa80a13af597a1fd03fcae3623de1428927e9
MD5 31fcdcdafacaf2eaa7f3b139ed0d091a
SHA1 e79cd36757ebc3a998e28397cb3d6c80a441e992
SHA512 0c5d93b19e81bff003a3beead9ad5702f32959704f999d3332da0e9a11796a5e32d3e24abc66a5cc3638c012461275a64ed80c1f0daceec1841d59c8d100ced3
SSDEEP 48:4W3b2wJ57czNyUw8mPuE50IBaOafHRa09fHRnfHRnfHR4fHRgfHRgfHRgfHR1fHw:zb9YRTmPuEiKF
TLSH
T13F91EFD4A33B9CA7D8F4E0D441B68F26640710B213FEBD695BADD218FD0DE6704B6690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remoteservice.settings.yanyu.tmp

Path C:\Users\Admin\AppData\Roaming\PreSonus\Studio One 4\remoteservice.settings.yanyu.tmp
Size 301B
SHA256 dd7fa5b4053d3a215778067539140ecff47b2fee78ded2b75a394b2b1db8f53f
MD5 3c24e5c343daa8153ee7d5bf7ab2323d
SHA1 653012de10477f398ffb7a4161302722f865dfee
SHA512 6720dbbcfec99f865744dc972015ad0c7c7dd52ec5341c9f05c03c0fdf95caa852a678ffbb66cc2caa6680351fa171a744751186c31425607eb246dfb8e36ec9
TLSH
T192E0C261A5A1EE734D418360EE49B2505369D089080660BCB9FE968A05AD5DB06BB16A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3508-22-0x0000000140000000-0x0000000140A2F000-memory.dmp

Download

memory/3508-21-0x0000000140000000-0x0000000140A2F000-memory.dmp

Download

memory/3508-19-0x0000000140000000-0x0000000140A2F000-memory.dmp

Download

memory/3508-23-0x0000000140000000-0x0000000140A2F000-memory.dmp

Download

memory/3508-198-0x0000000140000000-0x0000000140A2F000-memory.dmp

Download

memory/3508-20-0x0000000140000000-0x0000000140A2F000-memory.dmp

Download

memory/4256-11-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download

memory/4256-18-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download

memory/4256-60-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download

memory/4256-6-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download

memory/4256-5-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download

memory/4256-0-0x0000000000DD0000-0x00000000011EC000-memory.dmp

Download

memory/4256-172-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download

memory/4256-189-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download

memory/4256-1-0x00007FFA50ECF000-0x00007FFA50ED0000-memory.dmp

Download

memory/4256-227-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp

Download