OXLOADER mpr.dll Sandbox Abort — WNetAddConnection2W Malformed UNC Check

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects potential sandbox evasion behavior characteristic of OXLOADER malware. The rule identifies a non-system process dynamically loading 'mpr.dll' and terminating shortly thereafter (within 1 minute). This sequence is associated with anti-sandbox techniques where malware attempts to trigger an error (e.g., ERROR_BAD_NAME 0x43) via a malformed UNC path using 'WNetAddConnection2W' to detect if it is running within an analysis environment.