Analysis
- max time kernel
300s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 17:23
General
- Target unsecapp.exe
- Size 13.0MB
- Sample261107-vybs8sdv8x
- SHA256 d30a26d6f6676d700f86db8ff522cccfea285e1272f2dba210cf99c3b676a773
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 41 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- AutoIT Executable 39 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\unsecapp.exe"C:\Users\Admin\AppData\Local\Temp\unsecapp.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4116-0-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-1-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-2-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-4-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-9-0x00007FF6B6525000-0x00007FF6B6526000-memory.dmp
memory/4116-3-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-7-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-8-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-6-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-5-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-10-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-11-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-12-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-13-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-14-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-15-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-16-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-17-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-18-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-19-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-20-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-21-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-22-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-23-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-24-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-25-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-26-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-27-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-28-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-29-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-30-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-31-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-32-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-33-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-34-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-35-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-36-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-37-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-38-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-39-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-40-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp
memory/4116-41-0x00007FF6B6440000-0x00007FF6B7A3E000-memory.dmp