Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp5d91mhat.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp5d91mhat.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp5d91mhat.dll
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target tmp5d91mhat.dll
- Size 271KB
- Sample260602-hedr9sft6w
- SHA256 b8e75cbb6e4c360fec71e12b85f3c5e4933e66a64928ff4d337ebe6a6cc9150f
- MD5 33a68078df295fc4632015069da91aee
- SHA1 c41acf7b1cd8dde61b5662a23600e480f7126c78
- SHA512 0e6dc45d23f7a8e99a9bc8a8b52b169b3b50438f5955bea35a74fbefe26e7317ce20ac27a317d5d9564b42f0e5237efea0eaf3166b61f9592e0e63e2cf288383
- SSDEEP 6144:LaLGxt9EyAR8Z449UaxWHiat6AWl2SaaeRJZDE+aXx7mlpI:L3FEx4ia0FWl+aF+ah7Ky
- TLSH T1AD447B17B4ED9457F36623BC1CA13096D3AF83ACE819864298D20C810BDF5761EB9DED
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
zloader
Botnet
-
DLLobnova
Campaign
-
ogneniyupdate
C2
-
https://fdsjfjdsfjdsdsjajjs.com/gate.php
-
https://idisaudhasdhasdj.com/gate.php
-
https://dsjdjsjdsadhasdas.com/gate.php
-
https://dsdjfhdsufudhjas.com/gate.php
-
https://dsdjfhdsufudhjas.info/gate.php
-
https://fdsjfjdsfjdsdsjajjs.info/gate.php
-
https://idisaudhasdhasdj.info/gate.php
-
https://dsdjfhdsufudhjas.pro/gate.php
-
https://dsdjfhd9ddksaas.pro/gate.php
Attributes
-
build_id
17
rc4.plain
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Icoru = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Muyqo\\epis.dll,DllRegisterServer" msiexec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3296 msiexec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3840 set thread context of 3296 3840 rundll32.exe 82 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 3296 msiexec.exe Token: SeSecurityPrivilege 3296 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe 3840 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 792 wrote to memory of 3840 792 rundll32.exe 81 PID 3840 wrote to memory of 3296 3840 rundll32.exe 82 PID 3840 wrote to memory of 3296 3840 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp5d91mhat.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tmp5d91mhat.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-