f817a885da4dccbf2fca45dbce77e035a232956a8c31faeb3dad303ee0f84c4b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Borion.dll
Size 6.8MB
Sample260425-bsdabsay5w
SHA256 f817a885da4dccbf2fca45dbce77e035a232956a8c31faeb3dad303ee0f84c4b
MD5 4eced87926b262224a2b29b936ffdd7d
SHA1 03c28ef08cd962cd3f1d549795bd975ec1fc5099
SHA512 92a1b55f0bc985584270b9228ca7f146fa651ef7f065b555b553d4e23ff9c6134fb01b0f1d5a56b8cef8b362e505ff2246eee557368822c5e094b8cbd8a5fef6
SSDEEP 98304:nHc8cWuldGJVo7zPGc1j3lH2Q/G3U4MGU6G:nHvzSGEr
TLSH
T10666E43D24EF01B9E53281FACDDA2846DAF77C09832496CB950C5A9ECE7FE9C54A5C10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	748	rundll32.exe
3	748	rundll32.exe
4	748	rundll32.exe
5	748	rundll32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Borion.dll,#1
1⤵
- Badlisted process makes network request
PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads