Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 11:26
General
- Target _2000064d109841c9f620dec6dbba85c1ff6d3b17d4744893ce53ca9957aafa6d.dll
- Size 1.2MB
- Sample260709-nkdbkshv3m
- SHA256 2000064d109841c9f620dec6dbba85c1ff6d3b17d4744893ce53ca9957aafa6d
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\_2000064d109841c9f620dec6dbba85c1ff6d3b17d4744893ce53ca9957aafa6d.dll,#11⤵
- Badlisted process makes network request
- Drops startup file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Tmp14D6.tmp
memory/1372-236-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-239-0x000001EF98510000-0x000001EF98564000-memory.dmp
memory/1372-229-0x000001EF98310000-0x000001EF9832E000-memory.dmp
memory/1372-235-0x00007FFD4960F000-0x00007FFD49610000-memory.dmp
memory/1372-0-0x000001EF969A0000-0x000001EF969A1000-memory.dmp
memory/1372-237-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-241-0x000001EF98610000-0x000001EF9865C000-memory.dmp
memory/1372-240-0x000001EF984E0000-0x000001EF984F8000-memory.dmp
memory/1372-242-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-243-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-2-0x00007FFD69B90000-0x00007FFD69F31000-memory.dmp
memory/1372-245-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-244-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-238-0x00007FFD605B0000-0x00007FFD605CD000-memory.dmp
memory/1372-1-0x00007FFD6C2A0000-0x00007FFD6C503000-memory.dmp
memory/1372-256-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-257-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-258-0x000001EF969A0000-0x000001EF969A1000-memory.dmp
memory/1372-259-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-260-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp
memory/1372-261-0x00007FFD49480000-0x00007FFD49E24000-memory.dmp