Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:24
General
- Target libwinpthread-1.dll
- Size 3.0MB
- Sample260727-plcbcasvgx
- SHA256 3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#11⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\rundll32.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\rundll32.exe"C:\ProgramData\GitWinx86\rundll32.exe""2⤵
- Executes dropped EXE
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dpnhupnp.dll
rundll32.exe
DCRCVDrv.sys
memory/4844-4076-0x0000000000400000-0x0000000000470000-memory.dmp
memory/4844-4077-0x0000000074A22000-0x0000000074A23000-memory.dmp
memory/4844-4078-0x0000000074A10000-0x00000000751CC000-memory.dmp
memory/4844-4079-0x00000000056F0000-0x000000000570A000-memory.dmp
memory/4844-4080-0x0000000005720000-0x000000000574C000-memory.dmp
memory/4844-4165-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4178-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4204-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4202-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4200-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4198-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4196-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4194-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4192-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4188-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4186-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4184-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4182-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4180-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4176-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4174-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4172-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4170-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4168-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4162-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4158-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4156-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4154-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4150-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4149-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4146-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4144-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4142-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4140-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4138-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4136-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4134-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4132-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4128-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4126-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4122-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4118-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4116-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4114-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4110-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4108-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4106-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4104-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4102-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4101-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4098-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4096-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4094-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4092-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4090-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4190-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4166-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4160-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4152-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4086-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4130-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4124-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4120-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4084-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4112-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4082-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4081-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4088-0x0000000005720000-0x0000000005746000-memory.dmp
memory/4844-4705-0x00000000059C0000-0x0000000005A26000-memory.dmp
memory/4844-4706-0x0000000074A22000-0x0000000074A23000-memory.dmp
memory/4844-4709-0x0000000006B70000-0x0000000006C02000-memory.dmp
memory/4844-4710-0x00000000071D0000-0x000000000778A000-memory.dmp
memory/4844-4711-0x0000000074A10000-0x00000000751CC000-memory.dmp
memory/5676-4073-0x0000000000010000-0x000000000003D000-memory.dmp