Fileless Process Hollowing: .tmp File Mapped as Image Before ntdll.dll (Vidar/Turb00)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•1

Detects a signed host process (VirtualAr.exe, NeuroManag.exe) loading a .tmp file as an executable image. This behavior is indicative of a process-hollowing variant where a malicious payload is mapped directly into memory from a cached, non-flushed temporary file, a technique observed in campaigns like Operation Turb00 involving Vidar infostealer.