Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 17:50
General
- Target Client.exe
- Size 15.5MB
- Sample261027-wemxtseb82
- SHA256 0a8aa182cda50a9be584926927a3a1432bac28b8f1972de764663977fb3f6194
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 23 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tcpsvcs.exe"C:\Windows\system32\tcpsvcs.exe" Vape_V4.exe3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tcpsvcs.exe"C:\Windows\system32\tcpsvcs.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
base_library.zip
python310.dll
ucrtbase.dll
vcruntime140.dll
memory/2980-40-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-54-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-28-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-27-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-15-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-11-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-10-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-9-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-7-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-4-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-2-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-36-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-1-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-0-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-33-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-45-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-52-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-67-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-66-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-65-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-64-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-63-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-62-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-61-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-60-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-59-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-58-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-57-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-56-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-55-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-37-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-53-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-51-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-50-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-49-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-48-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-47-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-46-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-44-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-43-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-42-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-41-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-12-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-39-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-26-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-38-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-8-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-34-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-35-0x0000000140000000-0x000000014096E000-memory.dmp
memory/2980-32-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-31-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-30-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-29-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-24-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-25-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-23-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-22-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-20-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-21-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-19-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-18-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-17-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-16-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-14-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-13-0x0000000002190000-0x00000000022E1000-memory.dmp
memory/2980-243-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/2980-297-0x00007FF8E7AAD000-0x00007FF8E7AAE000-memory.dmp
memory/2980-322-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-428-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-433-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-431-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-430-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-427-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-288-0x00007FF8E7870000-0x00007FF8E7871000-memory.dmp
memory/2980-441-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-924-0x0000000140000000-0x000000014096E000-memory.dmp
memory/2980-1613-0x0000000140000000-0x000000014096E000-memory.dmp
memory/2980-1612-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/2980-954-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-925-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-927-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-928-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-926-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-951-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-953-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-783-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-1241-0x0000000140000000-0x000000014096E000-memory.dmp
memory/4080-1590-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-1591-0x0000000140000000-0x000000014096E000-memory.dmp
memory/4080-784-0x00007FF8E7A10000-0x00007FF8E7C05000-memory.dmp
memory/4080-561-0x0000000140000000-0x000000014096E000-memory.dmp