6ab03b2648804dfbad2bc4487eb71e36e859c1126268de961230f6eef417ea35

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AntiRecoil_patched.exe
Size 3.5MB
Sample261030-12dd5afv2x
SHA256 6ab03b2648804dfbad2bc4487eb71e36e859c1126268de961230f6eef417ea35
MD5 f296b059fe57a43f246a8b2ae0458a4f
SHA1 a54b327b5cc9af3c4660222f683e6368a94b7085
SHA512 a8ff3eb039ee3645c056f7edc21ad1f62a8970ed99acfda96bab4d9f9bc0e5229df66863029339e56d2fbcde26c506852e627f8c3f4fff32adf07c65b362900b
SSDEEP 98304:OT1bmGW3clyVEc1GbX6KgYIsB0SbRcxFiW:OT1hD5nKKZ0t2W
TLSH
T18FF5AE8366E840F6D866C275C5578A4FE7F278111B31E7CF41A0069E1FBB3A14DBA326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	AntiRecoil_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	AntiRecoil_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	AntiRecoil_patched.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AntiRecoil_patched.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmware	AntiRecoil_patched.exe

Loads dropped DLL 1 IoCs

pid	Process
1292	AntiRecoil_patched.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1292	AntiRecoil_patched.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AntiRecoil_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AntiRecoil_patched.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\VBOX	AntiRecoil_patched.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AntiRecoil_patched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	AntiRecoil_patched.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	AntiRecoil_patched.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	AntiRecoil_patched.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	AntiRecoil_patched.exe

C:\Users\Admin\AppData\Local\Temp\AntiRecoil_patched.exe
"C:\Users\Admin\AppData\Local\Temp\AntiRecoil_patched.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare services registry key.
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddhid.63340.dll

Path C:\Users\Admin\AppData\Local\Temp\ddhid.63340.dll
Size 2.1MB
SHA256 ae2b10387dbfc60ad8c59c3d579cf20e99bdfcc52cf7d4d8736f1948d0972eca
MD5 d2b83ed77f9cee3e4fc0e622b1870612
SHA1 ef17eb066530f2469761208c782862c29a6a393d
SHA512 8f57ba4a29a2d4c2f5e31e41b090434f717f0edc7a4d144fb2c2de1faedac5907230916a7f543f14576329ca6b03446847353c7eb36a465db185d47a66513809
SSDEEP 49152:hU8+m/zYIICd4u/1G9TVPme9hLZUC0PabR5fOxFiW2:hKgYIsB0SbRcxFiW2
TLSH
T1CBA57C5726E840B6DCA6C175C4678E5FD3F2B4111B71E3CF80A0069E5FBB3A10DAA326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads