Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 13:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
InternalBase.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
InternalBase.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target InternalBase.dll
- Size 11.2MB
- Sample260702-qjw4eae13z
- SHA256 1a6b8adac414718fd42084f2d0e41f8db79a7599c9bdfd10330cf68209b62bc3
- MD5 5a793a636bd84d36c9b16d0b016bfc5c
- SHA1 62d30cd450c8cdff04c47915c00c548b1cc475d0
- SHA512 950dfbb5f4f8f8cdfeb239442822e6a1047a93bebbe65eb11363e509a9950ae5da7539805b0453a3bacbe05acede5a38f10a36adabbd434f04c7c72b680bda3b
- SSDEEP 196608:rHAm8uKxtgsVqkwdmHJnPAY2hxM3eo2mk5YoY8Fx3lEA:rHQu2gTZdmHJPI4SfYV8FdlEA
- TLSH T14BC6BF46B5828F3FC12B1A3184D39F5B9674F484AF314A13339C6B2D6F973A45A93389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5636 rundll32.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com - Drops file in Program Files directory 37 IoCs
description ioc Process File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\kick.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\models\tm_phoenix.glb rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\minecraft-death-sound-effect.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\villager.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\[minecraft] old hitsound.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\ting.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\money claim.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\mouthsound.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\ahri2.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\satisfying-click.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\zelda.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\[minecraft] egg throw.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\spiral knight.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\negative_beeps-6008.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\fonts\ARCADECLASSIC.TTF rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\[minecraft] hitsound.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\pop.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\models\ctm_sas.glb rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\fortnite.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\[minecraft] bow ding.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\aimbooster.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\quaver.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\regulus.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\bonebreak.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\death-bong.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\sonicded.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\[minecraft] button.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\ben.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\brotato.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\tavern misc1c.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\trident pierce.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\water drop.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\amogus.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\death\dry-bones-death.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\[minecraft] XP gain.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\bonk.wav rundll32.exe File created C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\game\csgo\Kaizen\wav\click.wav rundll32.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5636 rundll32.exe 5636 rundll32.exe 5636 rundll32.exe 5636 rundll32.exe 5636 rundll32.exe 5636 rundll32.exe 5636 rundll32.exe 5636 rundll32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5636 rundll32.exe