3ae244ea473e01c7a36b4e508e934af31222132ee2a6850c01cd181f2f184163

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ae244ea473e01c7a36b4e508e934af31222132ee2a6850c01cd181f2f184163.dll
Size 553KB
Sample260416-ml3gesf17t
SHA256 3ae244ea473e01c7a36b4e508e934af31222132ee2a6850c01cd181f2f184163
MD5 85f9f0e9d7cfef6769369968e9ffd566
SHA1 a9816a52cede0ac73a80301968cf66c8ed4c371b
SHA512 1b1801a9ce2c242cbbc1a2e51d60117b71ecec489bbc20a8dae7340c94bca56259dc1057ebf5e91b0b326c2e83fcd761778a880ed28504ec961c9f55377478c3
SSDEEP 12288:/TM1uvukk6jfBTRbXHSXMFznp/roWFXcBgqZmX+R:LM1Lkk6jfxRLMMFznhqgqZtR
TLSH
T1D3C4D0707902C777D4C11571562DDAAB022DBDA10BA788C3E7E82E7AAC364C72736E53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	rundll32.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4632	rundll32.exe
4632	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4632	3496	rundll32.exe	84

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae244ea473e01c7a36b4e508e934af31222132ee2a6850c01cd181f2f184163.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ae244ea473e01c7a36b4e508e934af31222132ee2a6850c01cd181f2f184163.dll,#1
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:4632