Analysis
- user interaction
yes - max time kernel
149s - max time network
244s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 13:21
General
- Target jli.dll
- Size 177.5MB
- Sample260730-qlpr4sar21
- SHA256 7c0242f8adad73fbe444ef189528566dc0b342a0b4f1af41662855cb0f88b2a3
Malware Config
Extracted
-
onyxc2
-
akmuniverstall.top
-
port
443
-
url_path
/7e243e2b5c5ds7he/backend/api/app.php
Signatures
- Family: OnyxC2
OnyxC2 is a Windows backdoor written in C++.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DCRCVDrv.sys
memory/1480-7-0x0000000000010000-0x000000000003D000-memory.dmp
memory/2388-0-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2388-1-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2388-4-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2388-3-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2388-2-0x0000000180000000-0x0000000180450000-memory.dmp
memory/2388-38-0x0000000180000000-0x0000000180450000-memory.dmp
memory/4768-24-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-11-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4768-29-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-30-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-34-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-33-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-32-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-31-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-28-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-27-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-26-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-25-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4768-13-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4768-22-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-12-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4768-21-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-14-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-23-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-10-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4768-9-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4768-8-0x0000000140000000-0x0000000140323000-memory.dmp
memory/4768-45-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-99-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-73-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-111-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-139-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-174-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-122-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-71-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-206-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-249-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-259-0x0000000180000000-0x000000018030C000-memory.dmp
memory/4768-264-0x0000000180000000-0x000000018030C000-memory.dmp