Overview

overview

9

Static

static

3

build_1794...01.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    39s
  • max time network
    19s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 16:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    build_1794070442690_u240001.exe
  • Size 352KB
  • Sample261107-velt4aet9r
  • SHA256 1a198cc2f22dcc131c64f8c027cebe237fc2a60fa2e1583352775f5a90f7fcc6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build_1794070442690_u240001.exe
    "C:\Users\Admin\AppData\Local\Temp\build_1794070442690_u240001.exe"
    1⤵
    • Looks for VirtualBox drivers on disk
    • Looks for VMWare drivers on disk
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SYSTEM32\tar.exe
      tar.exe -xf "C:\Users\Admin\AppData\Local\Microsoft\AppBroker\jre.zip" -C "C:\Users\Admin\AppData\Local\Microsoft\AppBroker\jre.zip"
      2⤵
        PID:2928
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5212

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            jre.zip
            • Path C:\Users\Admin\AppData\Local\Microsoft\AppBroker\jre.zip
            • Size 41.8MB
            • SHA256 bc21a93923103cdaac93ee337b0ae4365e739fde36df823dd456bc67c8a9d352
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3544-12-0x00007FF75ED80000-0x00007FF75EDDE000-memory.dmp
            Download