d2f3110e8b6705f7757fd7415752a01c3ed4a9e7abe134f1a20b1ee73462a26d

Resubmissions

18/04/2026, 02:33

260418-c1tsqae18v5

18/04/2026, 02:32

260418-cz9sjse17x5

Analysis

user interaction
yes
max time kernel
298s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ck-dce6bcbb1a728ea8d871de6d169a2057.dll
Size 1.4MB
Sample260418-c1tsqae18v
SHA256 d2f3110e8b6705f7757fd7415752a01c3ed4a9e7abe134f1a20b1ee73462a26d
MD5 7a2168d7ae1364ae34360f56f7ad5f2c
SHA1 e78b01d42d34f64c33d37d71c2b98e6c05678942
SHA512 588901d8f6f189416dca5a1dc94c80664e86ee19d6986e7cd34de8e51b8a190241b46a853479fd37ef92051fabd0a6d66f93f4a735091d646759dcbfd98b0e6f
SSDEEP 12288:Z5icKLkFI9kFRe0TzGA0gb8IkKhF87MXff5pIvru888888888888W8888888888B:ZIRLkFIC79ToM8IB/EMXff5pIvrOfqD
TLSH
T1B765A2619472816EF9A9003F51156A33B8FF6AC312D2EC2E4E397FDD41265D24AFB243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 5652	2080	rundll32.exe	86
PID 3748 wrote to memory of 2156	3748	cmd.exe	105
PID 3748 wrote to memory of 5864	3748	cmd.exe	106

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ck-dce6bcbb1a728ea8d871de6d169a2057.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ck-dce6bcbb1a728ea8d871de6d169a2057.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\system32\rundll32.exe
  rundll32.exe ck-dce6bcbb1a728ea8d871de6d169a2057.cloudflare
  2⤵
  PID:2156
- C:\Windows\system32\rundll32.exe
  rundll32.exe "ck-dce6bcbb1a728ea8d871de6d169a2057.cloudflare",EswTimer
  2⤵
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5652-0-0x0000000000900000-0x0000000000A20000-memory.dmp

Download