c259d9fc53b7d3492bd20b42ef36924a615bf2562c3d6d00228ecbe863a916a7

Analysis

max time kernel
100s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
02/09/2025, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c259d9fc53b7d3492bd20b42ef36924a615bf2562c3d6d00228ecbe863a916a7.dll
Size 311KB
Sample250902-nl9feavsgv
SHA256 c259d9fc53b7d3492bd20b42ef36924a615bf2562c3d6d00228ecbe863a916a7
MD5 8157be7acc05f719dc125d677133ca40
SHA1 8cc955f6a24b9cbbb028924da165f4a3ab763455
SHA512 54d586f3360dc04ffa23365d2f07a97f2b08657cae626e0266c1a6f163e2c0409c796d3159ef408446983a9f5200906f07743a0b881a81b2b18368e853f8e78d
SSDEEP 3072:O4MbjPjzaCAbkHWh2RXfZ1mu1rgKLMmjixAMy6ku9bDiYYdXmhnDKUmE:jg+T0IMB1muKKLHGipulmzRE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

execution persistence

Malware Config

Signatures

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1736	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 4316	5724	rundll32.exe	79
PID 5724 wrote to memory of 4316	5724	rundll32.exe	79
PID 4316 wrote to memory of 1736	4316	cmd.exe	81
PID 4316 wrote to memory of 1736	4316	cmd.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c259d9fc53b7d3492bd20b42ef36924a615bf2562c3d6d00228ecbe863a916a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\TEMP\FROX\cross.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "PerformTaskMaintain" /tr "C:\Windows\System32\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\FROX\PLAIN.dll",bostrecover" /sc minute /mo 4
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cross.bat

Path C:\Users\Admin\AppData\Local\TEMP\FROX\cross.bat
Size 134B
SHA256 4887cade99997d49900930f3a2dcfc0862b0e8309e3c6f43f2867f7649737b53
MD5 b3914c7c87716510abc3940d231109bd
SHA1 38b6785c1eca5c4d7156a6e347c62ddcddf1da95
SHA512 793ea44b88697ffd51c05ceb542886bf236c79addc16b37dfffc39df15f65c1f7bd12648644943c0cf371546ff51825c75817b177e7e6fa8e01bc589553311ef
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads