009309e481137f26e44ad57d9d6883e7ac3e2cf6b8f0097774ceadb679b11f3d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
009309e481137f26e44ad57d9d6883e7ac3e2cf6b8f0097774ceadb679b11f3d.dll
Size 1.0MB
Sample260601-gxe8dadv4v
SHA256 009309e481137f26e44ad57d9d6883e7ac3e2cf6b8f0097774ceadb679b11f3d
MD5 e12ddcee6e8ff10412b8d21af20d06e9
SHA1 fc28a23616aa194423b95edfcb98e1ba235f4707
SHA512 68504516b7d933c606486d937958cfd32cba388435a362621db3a17314801acf443c4d4e9fb016d9e4cb8b290109d9cd1823466abffa1316ec9b8973c6bada6a
SSDEEP 24576:97Nv4SCfNZQsd3qAm9ll5OWkZo519UHR:7v4DXz3qxRksWR
TLSH
T1C735F2303601C836E84229749B2CDB6B267EAD654FB584C3E3D4096AAE714D32B37F57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	rundll32.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe
2504	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 2504	864	rundll32.exe	81

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\009309e481137f26e44ad57d9d6883e7ac3e2cf6b8f0097774ceadb679b11f3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\009309e481137f26e44ad57d9d6883e7ac3e2cf6b8f0097774ceadb679b11f3d.dll,#1
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:2504