Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 10:51
General
- Target bin/res.exe
- Size 11.5MB
- Sample261027-mx2dhadt6l
- SHA256 c5002ed4869d998b79b13c8365af9d7403f80d7218ad34f429f94fc662e33ebd
Score
4/10
Malware Config
Signatures
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\res.exe"C:\Users\Admin\AppData\Local\Temp\bin\res.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4116-1-0x000001CCB7690000-0x000001CCB7691000-memory.dmp
memory/4116-0-0x000001CCB7690000-0x000001CCB7691000-memory.dmp