b67b83f78ebcc7db4a94ec331ab4daee3bf9f46cc8116c62f15f087c07685d35

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260126-en
resource tags

arch:x64arch:x86image:win10v2004-20260126-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.dll
Size 1.2MB
Sample260127-vrp3aahs2a
SHA256 b67b83f78ebcc7db4a94ec331ab4daee3bf9f46cc8116c62f15f087c07685d35
MD5 c5c013a2adab4975d53ec472b00b93a8
SHA1 f193864f6b4fd443eba840a3842d2627294dce87
SHA512 e0670e3a6d6854488e32cef988e81549f9bd8611cf3e3ee10196ab5c87f19cbee13a546720debf430907c53f9ae104caedaa57e6eff6e96fd568ec6c1e84c245
SSDEEP 24576:UzR0NWv30/UH9Cksn6JCM23gN0YxuB5tczwem3cArXc5:UMV/G9CkhR2YuB5tOwefq
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4172	rundll32.exe
4	4172	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4432	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4436	netsh.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4432	powershell.exe
4432	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4436	4172	rundll32.exe	85
PID 4172 wrote to memory of 4432	4172	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\566553252106_Desktop.zip' -CompressionLevel Optimal
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

566553252106_Desktop.zip

Path C:\Users\Admin\AppData\Local\Temp\566553252106_Desktop.zip
Size 17KB
SHA256 27c2d94e3783e537bdf95fd4862ee1e6f39257966af5e92018a2573f40975fac
MD5 d4d9bd1b63ffa221c757724c78d12dbe
SHA1 a589b60f5408f0af64ebd7c92ac491d6c3c257ee
SHA512 972e39525f6010fbfb3a28971b4ae0fe56edfee6a20053cdaffef3658b923cede781521ec39bcabeb7bd4d6270b3cb1e07634e5328231bd1b1ae765c491b2a3e
SSDEEP 384:FvwIdEnk7NN08LY6hwBQSYAhY296jl6C8c:FIIdEnF806hTLAx94r
TLSH
T13C72E1C6880F178BD20AB8B602E6CEDD44C7516C20799A4B68C5BCFFB03723B4867295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveMount.xlsx

Path C:\Users\Admin\AppData\Local\Temp\_Files_\RemoveMount.xlsx
Size 11KB
SHA256 1404521691fb15046e4f4cf74630a29bebf6c779e90bd4c83bf2c2ddaaacd6ce
MD5 0ad7a439f49f2681a5310ba87a5c869c
SHA1 00eeed70dba60b4e7e9689b2dadc4914619cd317
SHA512 86037ac1d6b612509fe6ed87692998bab58e2bdd5ce98edac9b0b2f27624fee8730cfd66ef7d3a72be329f83ae15c0110150c2689ef61a454bdccca12801d04c
SSDEEP 192:wc8mV02cAAcb3USGnk7/COnaFUlbVvevUqzQXpS0+fv8H+Auhao4qJ:wc3rvh3rTCO8UlM9z6pI8efaoT
TLSH
T1E032AD1AD5E15478C3374C3EC1AB00C2729D9194AF0939876461F14EA7826BB13AF3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartWrite.xlsx

Path C:\Users\Admin\AppData\Local\Temp\_Files_\StartWrite.xlsx
Size 10KB
SHA256 4dbdb31a54425dc811565e5427a77da119ae56848d6537093914bb680e6dbc44
MD5 74add9019671fa1f5c7a971ce1565e36
SHA1 2f10c630dcf478434df1e90654003b7ae3989796
SHA512 752e26e9aa0436b178fa25a95586c03bda65e03463e84846f29f81c15501865a691e51896e2c9eb4659923c298a9e205947499812a658e911b446fe03a9f1d65
SSDEEP 192:wc8mVI/x4dVOEb3UTc/hamlTZcaFUlbVvevUqzQXpS06C32oBN1bfPyaob2:wc3iWx3P7lTPUlM9z6pSCZznyaob2
TLSH
T1F8228D5A9560647DC626003FC2AE40EAF50E65C2A747F0C67475F25F228028713BF2FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zj5a5vud.fol.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zj5a5vud.fol.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4432-2-0x000002A92ED50000-0x000002A92ED60000-memory.dmp

Download

memory/4432-3-0x000002A92ED50000-0x000002A92ED60000-memory.dmp

Download

memory/4432-4-0x000002A92ED20000-0x000002A92ED42000-memory.dmp

Download

memory/4432-12-0x000002A94A0A0000-0x000002A94A0B2000-memory.dmp

Download

memory/4432-13-0x000002A94A080000-0x000002A94A08A000-memory.dmp

Download