Overview

overview

7

Static

static

3

25d_rhino3.exe

windows10-2004-x64

7

25d_rhino3.exe

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    415s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/06/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    25d_rhino3.exe
  • Size 2.4MB
  • Sample260601-ejrm5sb15s
  • SHA256 2a167bcb8fa11a1a7d06a91b989cc418576a482dde6c0ba8c9d3c03bf969e7a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 16 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25d_rhino3.exe
    "C:\Users\Admin\AppData\Local\Temp\25d_rhino3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:656
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3740
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2720
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4744
    • C:\Users\Admin\AppData\Local\Temp\25d_rhino3\Roland_ 25D_for_Rhino_30_ver106\25DForRhino30.exe
      "C:\Users\Admin\AppData\Local\Temp\25d_rhino3\Roland_ 25D_for_Rhino_30_ver106\25DForRhino30.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\Disk1\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\Disk1\Setup.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe
          "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe" -RegServer
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2372
    • C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exe
      C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exe -Embedding
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe
        "C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2756
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SDRSVC
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:536
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\25d_rhino3\Roland_ 25D_for_Rhino_30_ver106\Readme.txt
      1⤵
        PID:3680

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            corecomp.ini
            • Path C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\corecomp.ini
            • Size 27KB
            • SHA256 5214789c08ee573e904990dcd29e9e03aaf5cf12e86fae368005fd8f4e371bd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IScript.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\IScript\IScript.dll
            • Size 220KB
            • SHA256 4f77a9018b6b0d41151366e9acab3397416d114fc895703deb82b20f40116ad1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IKernel.exe
            • Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe
            • Size 600KB
            • SHA256 985eb55ecb750da812876b8569d5f1999a30a24bcc54f9bab4d3fc44dfedb931
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ctor.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
            • Size 76KB
            • SHA256 590be865ddf8c8d0431d8f92aa3948cc3c1685fd0649d607776b81cd1e267d0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            iuser.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
            • Size 172KB
            • SHA256 8efcbd8752d8bbfd7ee559502d1aa28134c9bf391bf7fc5ce6fdfd4473599afb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            objectps.dll
            • Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
            • Size 32KB
            • SHA256 32c6ad91dc66bc12e1273b1e13eb7a15d6e8f63b93447909ca2163dd21b22998
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            25DForRhino30.exe
            • Path C:\Users\Admin\AppData\Local\Temp\25d_rhino3\Roland_ 25D_for_Rhino_30_ver106\25DForRhino30.exe
            • Size 2.4MB
            • SHA256 70bfcdc8f9544b25e0f5994f5b5e19f58b2416c4b682ec160a55eeb6c6c49fb1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Readme.txt
            • Path C:\Users\Admin\AppData\Local\Temp\25d_rhino3\Roland_ 25D_for_Rhino_30_ver106\Readme.txt
            • Size 2KB
            • SHA256 57d9a4e8d6d8aa07d4f4c50980dfd3d881e6c6c2c1635b687d7f76e029785f8d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            IKernel.ex_
            • Path C:\Users\Admin\AppData\Local\Temp\PFTCF2~1\Disk1\IKernel.ex_
            • Size 338KB
            • SHA256 fbf95719b956b548b947436e29feb18bb884e01f75ae31b05c030ebd76605249
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Setup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\Disk1\Setup.exe
            • Size 40KB
            • SHA256 03cacf9199912dba9ef3cd85349b21f9494518b4370c2979f5a98cf79605fa85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data1.cab
            • Path C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\Disk1\data1.cab
            • Size 463KB
            • SHA256 9ff4617d933e80e7c0fa5d97800670194923161947fafab0d1efa0541f8ec27f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            layout.bin
            • Path C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\Disk1\layout.bin
            • Size 416B
            • SHA256 cd285fcec5f0dbe840c5a02ce507700354f5d5861542dab8df530b556ae39ebf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            setup.ini
            • Path C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\Disk1\setup.ini
            • Size 132B
            • SHA256 024bd0aac04b752ea12d01103cba92914fafc5dbc6ca6acc18997fd9f07f5388
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            setup.inx
            • Path C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\Disk1\setup.inx
            • Size 127KB
            • SHA256 1d66d1cd496946119a446688f9f48ce12d909e6f4abd14469de63f181daaad1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pftw1.pkg
            • Path C:\Users\Admin\AppData\Local\Temp\pftCF21~tmp\pftw1.pkg
            • Size 2.3MB
            • SHA256 6ebe5ff350e70c8286979f17e645fa714f177654baa1a09eca3d4a2cf2b8e263
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            plfCE92.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\plfCE92.tmp
            • Size 4KB
            • SHA256 f9efb3e6fe099c649fb4cc20ac6f9b7e90d3f60b8d98f48fb5d167f1a0b1b7f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _IsRes.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{32799d3b-6fd3-4c3b-992d-b827694208dd}\_IsRes.dll
            • Size 212KB
            • SHA256 0888d2a696ca222ebc35641502548e5b79b55c9f7c094466a1a52d9d4d429a64
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            isrt.dll
            • Path C:\Users\Admin\AppData\Local\Temp\{32799d3b-6fd3-4c3b-992d-b827694208dd}\isrt.dll
            • Size 312KB
            • SHA256 d71dc33bed67eec58af8148b8e529c4bc0364a86a5dbed66741a9d8802e3f2c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            data1.hdr
            • Path \??\c:\users\admin\appdata\local\temp\pftcf21~tmp\disk1\data1.hdr
            • Size 13KB
            • SHA256 c2e5e074572b4c6468ac37259bfa850382a050eea059459df9f914b01441113e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/656-6-0x0000000000400000-0x000000000040C000-memory.dmp
            Download

            memory/3060-139-0x00000000030F0000-0x0000000003103000-memory.dmp
            Download

            memory/3060-145-0x0000000003110000-0x0000000003148000-memory.dmp
            Download

            memory/3060-159-0x0000000003260000-0x000000000328C000-memory.dmp
            Download

            memory/3060-153-0x00000000034A0000-0x00000000034F1000-memory.dmp
            Download