Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 17:08
General
- Target CadenceLicensePatcherWin.exe
- Size 9.7MB
- Sample261107-vnv45azs2n
- SHA256 9c97a745de5706db766f9e411b31e26ab63fa444ed4701ff7416401c2f2cff7d
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 2 IoCs
- Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CadenceLicensePatcherWin.exe"C:\Users\Admin\AppData\Local\Temp\CadenceLicensePatcherWin.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bass.dll
flexnetpatchlibrary.dll
memory/4520-25-0x0000000008810000-0x000000000885E000-memory.dmp
memory/4520-28-0x0000000008A40000-0x0000000008A70000-memory.dmp
memory/4520-8-0x0000000071600000-0x000000007164B000-memory.dmp
memory/4520-11-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-1-0x0000000000310000-0x0000000000CD2000-memory.dmp
memory/4520-16-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-17-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-18-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-19-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-20-0x00000000063D0000-0x000000000698A000-memory.dmp
memory/4520-21-0x0000000005EB0000-0x0000000005F42000-memory.dmp
memory/4520-22-0x0000000006050000-0x000000000620E000-memory.dmp
memory/4520-23-0x0000000006230000-0x00000000062DA000-memory.dmp
memory/4520-24-0x0000000006340000-0x000000000634A000-memory.dmp
memory/4520-0-0x0000000074642000-0x0000000074643000-memory.dmp
memory/4520-26-0x00000000087E0000-0x0000000008804000-memory.dmp
memory/4520-2-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-29-0x000000000A120000-0x000000000A236000-memory.dmp
memory/4520-27-0x00000000088B0000-0x00000000089FA000-memory.dmp
memory/4520-30-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-31-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-32-0x0000000074642000-0x0000000074643000-memory.dmp
memory/4520-33-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-35-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-36-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-37-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-38-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-39-0x0000000074630000-0x0000000074DEC000-memory.dmp
memory/4520-41-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-42-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-48-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-51-0x0000000070D30000-0x0000000071595000-memory.dmp
memory/4520-52-0x0000000070D30000-0x0000000071595000-memory.dmp