98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 11:14

Target
BoostrapplerNET/runtimes/app.asar.unpacked/node_modules/btime/binding.dll
Size 118KB
Sample260527-nb5dpscs4l
SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
MD5 13a2579ed95366185a6247c9e4b9f0cc
SHA1 61fef12da622484e44b3c9ddcd61706c9af00aa0
SHA512 7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
SSDEEP 1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t
TLSH
T1ECC36C57B2E541BFD4768278C9930A45D3B2B82507309BDF07A4425A1F237E1AE3EB72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

pid	Process
2972	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BoostrapplerNET\runtimes\app.asar.unpacked\node_modules\btime\binding.dll,#1
1⤵
- System Time Discovery
PID:2972

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact