Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 12:24
General
- Target libwinpthread-1.dll
- Size 3.0MB
- Sample260727-plcbcasvgx
- SHA256 3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll,#11⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\rundll32.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\rundll32.exe"C:\ProgramData\GitWinx86\rundll32.exe""2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dpnhupnp.dll
rundll32.exe
DCRCVDrv.sys
memory/1084-4006-0x0000000000400000-0x0000000000470000-memory.dmp
memory/1084-4007-0x0000000005750000-0x0000000005760000-memory.dmp
memory/1084-4008-0x00000000058D0000-0x00000000058EA000-memory.dmp
memory/1084-4009-0x0000000005940000-0x000000000596C000-memory.dmp
memory/1084-4115-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4079-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4027-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4017-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4010-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4015-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4011-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4133-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4131-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4129-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4127-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4125-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4123-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4121-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4119-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4117-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4113-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4112-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4109-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4107-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4105-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4103-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4101-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4099-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4097-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4095-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4093-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4091-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4089-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4087-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4085-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4083-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4081-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4077-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4075-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4073-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4071-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4069-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4067-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4065-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4063-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4061-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4059-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4057-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4055-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4053-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4051-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4049-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4047-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4045-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4043-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4041-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4039-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4037-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4035-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4033-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4031-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4029-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4025-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4024-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4021-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4019-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4013-0x0000000005940000-0x0000000005966000-memory.dmp
memory/1084-4634-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/1084-4637-0x0000000006D60000-0x0000000006DF2000-memory.dmp
memory/1084-4638-0x00000000073B0000-0x0000000007954000-memory.dmp
memory/1084-4639-0x0000000005750000-0x0000000005760000-memory.dmp
memory/3336-4003-0x0000000000010000-0x000000000003D000-memory.dmp