Overview

overview

8

Static

static

7

4550b9f220...77.dll

windows10-2004-x64

8

4550b9f220...77.dll

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4550b9f220d5ace5d68c2fa33176d0fff3ab4b80902d53fa005704f7d224c277.dll
  • Size 7.3MB
  • Sample260731-phjagsad38
  • SHA256 4550b9f220d5ace5d68c2fa33176d0fff3ab4b80902d53fa005704f7d224c277
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverythemida

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Drops file in System32 directory 39 IoCs
  • Drops file in Windows directory 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4550b9f220d5ace5d68c2fa33176d0fff3ab4b80902d53fa005704f7d224c277.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4550b9f220d5ace5d68c2fa33176d0fff3ab4b80902d53fa005704f7d224c277.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Users\Admin\AppData\Local\Temp\mR3XQJWlLVmPQGjmJ8X7VhVvK6mnghIo.dat
        "C:\Users\Admin\AppData\Local\Temp\mR3XQJWlLVmPQGjmJ8X7VhVvK6mnghIo.dat" -i
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:5348
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{eaa666af-1209-2947-818d-6856d991d5bb}\logi_joy_vir_hid.inf" "9" "495eb7267" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Users\Admin\AppData\Local\Temp\40df2374-c0fd-4f97-8d91-4fedcb142d2b"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:4680
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cae2b171-5dcb-804d-8a2c-fd11dc21b9dc}\logi_joy_bus_enum.inf" "9" "45b7fd7bb" "0000000000000198" "WinSta0\Default" "000000000000017C" "208" "C:\Users\Admin\AppData\Local\Temp\3172994a-fe44-4c34-a4bc-1c90330b99f0"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:5564
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "1" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_6be489e971884a83\logi_joy_bus_enum.inf" "oem2.inf:*:*:2026.0.0.0:root\LGHUBVirtualBus," "45b7fd7bb" "0000000000000198" "4ad9"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4992
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1616
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "0" "LGHUBDevice\VID_046D&PID_C232\1&79f5d87&0&01" "" "" "409067b8f" "0000000000000000" "4ad9"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3816
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "0" "LGHUBDevice\VID_046D&PID_C231\1&79f5d87&0&02" "" "" "41dc813d3" "0000000000000000" "4ad9"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2748

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        logi_joy_bus_enum.cat
        • Path C:\Users\Admin\AppData\Local\Temp\3172994a-fe44-4c34-a4bc-1c90330b99f0\logi_joy_bus_enum.cat
        • Size 15KB
        • SHA256 445c9ec46cf438eb6393efc87d7ebbe9b3c65295831f718b5eab2c57771fadb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logi_joy_bus_enum.inf
        • Path C:\Users\Admin\AppData\Local\Temp\3172994a-fe44-4c34-a4bc-1c90330b99f0\logi_joy_bus_enum.inf
        • Size 3KB
        • SHA256 d42714f5b7bd861cc9e8a5733f881457aa080e512c43045e98e1aadcf569bfa5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logi_joy_bus_enum.x64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\3172994a-fe44-4c34-a4bc-1c90330b99f0\logi_joy_bus_enum.x64.sys
        • Size 44KB
        • SHA256 79065269b2009dae18cdf5d9090fe8bab98dcfc1c52e66f91d62f47038192e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logi_joy_xlcore.x64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\3172994a-fe44-4c34-a4bc-1c90330b99f0\logi_joy_xlcore.x64.sys
        • Size 72KB
        • SHA256 38f5cf58e4b4b58e3c89428482a2b6570aa38d3f4ace9ce5a1f964f3a753e488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logi_joy_vir_hid.cat
        • Path C:\Users\Admin\AppData\Local\Temp\40df2374-c0fd-4f97-8d91-4fedcb142d2b\logi_joy_vir_hid.cat
        • Size 14KB
        • SHA256 0b65343dffaeb73eec45a1b7502ea39682c9adfb5abe6be70117309a72951e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logi_joy_vir_hid.inf
        • Path C:\Users\Admin\AppData\Local\Temp\40df2374-c0fd-4f97-8d91-4fedcb142d2b\logi_joy_vir_hid.inf
        • Size 3KB
        • SHA256 643feee9750417cb98257f3c12ffe2751aef3c9d94c15b64d5b0a9ca2fb995ea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logi_joy_vir_hid.x64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\40df2374-c0fd-4f97-8d91-4fedcb142d2b\logi_joy_vir_hid.x64.sys
        • Size 31KB
        • SHA256 fd9bb208da3931926c771d3fee0fa7533e54dc876dcbd830cfdbe28e76d04911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mR3XQJWlLVmPQGjmJ8X7VhVvK6mnghIo.dat
        • Path C:\Users\Admin\AppData\Local\Temp\mR3XQJWlLVmPQGjmJ8X7VhVvK6mnghIo.dat
        • Size 888KB
        • SHA256 5f00e8e24d6af6eed7b9e15cf201ec7d7f7e654f6daabdda5313cb394f644468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 63KB
        • SHA256 417d962dbd040afa63f3f4d2174e078f0dc5b0161686f9037fa32ba8905e10de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logi_joy_bus_enum.inf_amd64_6be489e971884a83.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\logi_joy_bus_enum.inf_amd64_6be489e971884a83.ini
        • Size 585B
        • SHA256 7a6762779f3e4a8fa04ae7f11c70b03258671574964ceea1d97d4246522ae97a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        logi_joy_vir_hid.inf_amd64_2a969ae23b22f16c.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\logi_joy_vir_hid.inf_amd64_2a969ae23b22f16c.ini
        • Size 456B
        • SHA256 eff1ea9bde0cffa4acfd6d168cc0040c63a70e63886d77237ed34a15d5834aa3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1292-1-0x0000000001070000-0x0000000001071000-memory.dmp
        Download

        memory/1292-8-0x0000000010000000-0x0000000010C70000-memory.dmp
        Download

        memory/1292-4-0x0000000010000000-0x0000000010C70000-memory.dmp
        Download

        memory/1292-0-0x00000000100F7000-0x0000000010520000-memory.dmp
        Download