e60bc80e3826a2c275ab381503c54a881a0ed5e53888db7584120f9119600969

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e60bc80e3826a2c275ab381503c54a881a0ed5e53888db7584120f9119600969.dll
Size 7.0MB
Sample260708-16ykvsax71
SHA256 e60bc80e3826a2c275ab381503c54a881a0ed5e53888db7584120f9119600969
MD5 b05f5cdb2f9d5df4ada0ac447ca86d85
SHA1 a670655876d3b537b527b88f181e3fbf08a6879e
SHA512 1da46c1c07def425af0c79c1ea5c2119d3786470da4b42adc87b4aa7cb84dbca797c00df28db8561cbd59a0ac54297d89f3f9a57b5f64ea02c14459f5d1b70c8
SSDEEP 98304:i4+h/1sFwqdikEyMlN8urukU5mU5YrDwZ9p1XtsJ6JiCW4RFCiAXYf6Xpfj:p/iqQl7rukIvn1XtsJ1CPDCiAXYf6Xp7
TLSH
T108760113B7D080B2D5AB01761567973A9B7AFA110724C9C3A7D02E4D2F716D2BA3E34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3840	rundll32.exe
17	3840	rundll32.exe
20	3840	rundll32.exe
22	3840	rundll32.exe
23	3840	rundll32.exe
24	3840	rundll32.exe
25	3840	rundll32.exe
26	3840	rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4592	3840	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "e93ef50b05f2303a89bca143882e6d3e"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "knmjmrhsaizlduz9bk5bsrqnxvix"	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3840	3716	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e60bc80e3826a2c275ab381503c54a881a0ed5e53888db7584120f9119600969.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e60bc80e3826a2c275ab381503c54a881a0ed5e53888db7584120f9119600969.dll,#1
  2⤵
  - Badlisted process makes network request
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1080
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3840 -ip 3840
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hg.dat

Path C:\ProgramData\Kingsoft\KIS\hg.dat
Size 53B
SHA256 33b6084689b1cd284cafa90453a3878ec0fa2893e895074cb51dfa4d6789e3bd
MD5 1a6edb1684ce255a81e006bfb5c24594
SHA1 48085b20a9ebf8b928e218f5c44012fe923cbe12
SHA512 7cb42342fee3ae4ae5fb3f0bf24aafaa37968bd27fa79e7c993e428e42c68150814f4af0ddd5efecb60a911160e7fc3c7192e159401125626d87f5a85eb8e84a
TLSH
T1C29002595548117F49247363A439167D2038884180C541B14A8906452419446445676F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3840-0-0x0000000010000000-0x00000000103BB000-memory.dmp

Download