5d411570fc456403797add124bcef890238c2c94c7997972db30121132e81a95

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sub_5d411570fc45.dll
Size 180KB
Sample260524-bt6chadv4p
SHA256 5d411570fc456403797add124bcef890238c2c94c7997972db30121132e81a95
MD5 e10a9df3745684581ea3cf5ab22e3e90
SHA1 d15f43f14372862111560cdcf48fd3c15418f1ea
SHA512 923a6d3af4bd4cd805d2bc589dd3723c4e59ee626844d480c6189085d774240af2c8f33f9da7e9fabbc38d56f59a55b21fbe0a3130674a181bb4523ea1ad6183
SSDEEP 3072:TtnUNALmVZvvGBeLYejpkIAq2tn2TBfki43y97FozS4Oq1sqH73oGC:p4LvkRejpequn2TB8i4i0zLOosqHkG
TLSH
T16E048E0A9B9702A3DAA4043071945ABB7FBE7C3338DF646FCB165A3115A15C5D034EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2380	msupdate.exe

Loads dropped DLL 2 IoCs

pid	Process
4596	rundll32.exe
4596	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\ECELP4.ACM	msupdate.exe
File created	\??\c:\windows\SysWOW64\shelldoc.dll	msupdate.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\MSAgent\AGENTCPD.DLL	msupdate.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	rundll32.exe
4596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4596	4380	rundll32.exe	79
PID 4596 wrote to memory of 2380	4596	rundll32.exe	80
PID 2380 wrote to memory of 2520	2380	msupdate.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sub_5d411570fc45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sub_5d411570fc45.dll,#1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\msupdate.exe
    C:\Users\Admin\AppData\Local\Temp\msupdate.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 C:\Windows\MSAgent\AGENTCPD.DLL _start@16 0
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msupdate.exe

Path C:\Users\Admin\AppData\Local\Temp\msupdate.exe
Size 104KB
SHA256 9e77faba3137c28572ce9e7bc62897139451aeb99c68958c457214cf8b1cc723
MD5 ddc9915a5158a9560ad1ef2f16cce9a6
SHA1 a870bf68ad03940ff2fc61a4ba2c5c1cc53aa252
SHA512 7da029adb7137b9b4b92e6fefbbb114ec91a312ab87284e5cd2ff3099e9f7a4aea478171112755592eb9f99820a19525c42c62da91ef0dc80d677bd14f874f49
SSDEEP 3072:QIAq2tn2TBfki43y97FozS4Oq1sqH73oGz:qqun2TB8i4i0zLOosqHkGz
TLSH
T1DEA3BF574ACB09E3E5B4183071D45ABD8FFEBA333895347FCB0A4D1254A169AE0781EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shelldoc.dll

Path C:\Windows\SysWOW64\shelldoc.dll
Size 52KB
SHA256 6eb00b34d1daffa49b2f4c90841705b2c994563bde672bf35eb1c46cdb19a1ed
MD5 03f8cfdf5e6d9ecdff1cab3e47d39f44
SHA1 a9fbfe65a3d44a55bfdf0bd01c6c61f436139447
SHA512 6e7cec13f27e602bf5105c1f34417d4ceb2ce614a9b4cbe0636a8af68988348297ed5300ece7d4af802c23d476dcb9d0dc528b0b8efb85a64302f07b8af0ea5c
SSDEEP 768:6wd9l+HXrc94NTLpdU7TaHyz1IrIMzW6qWkpAk9vL6ntoY5Gb2:P98c94pE7TaHyzP6qWkpASvyoxb2
TLSH
T18B334B1E654200BFDCDD4676CF6D1B6ABF6EA8A303D0E5C38B2DD9D9582E0D0613A352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4596-12-0x0000000000600000-0x000000000060F000-memory.dmp

Download