wingo loader process hollowing (image-load-before-ntdll + remote thread) delivers Vidar into VirtualAr.exe/NeuroManag.exe

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•4

Detects anomalous process injection behavior characteristic of the Turb00 operation (e.g., Go-loader/HijackLoader variants). The rule identifies a two-stage signal: first, the mapping of an unbacked or unusually named executable image into a process before the loading of ntdll.dll; and second, the subsequent invocation of sensitive process manipulation APIs like CreateRemoteThread or SetThreadContext on the same host within a 10-minute window, consistent with process hollowing.