05d6e05d63c2fba753c459d2bffaf99118eb405eff2fdb9d11cb39ee4c9ae87f

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
teamspeak_control.dll
Size 192KB
Sample260731-rt43fabh76
SHA256 05d6e05d63c2fba753c459d2bffaf99118eb405eff2fdb9d11cb39ee4c9ae87f
MD5 6f2caa4f8d656752fdc76a0f5a3b606b
SHA1 e8957e08d0ea323b26b987e386db11ae96742f27
SHA512 cdf502f6347a67208422ccf4899ec77d8c2dff4f575d8c8d3b1af40498cd171ad7ccf9182d134db282529d7f66d49cce9a9c15c418373e840a6c007840460fe8
SSDEEP 6144:AgUyrG1TBJ7LGwwYDBkyJpIvAXQX3DwhrRmL:AgMnsJQ59XQwrRmL
TLSH
T1DA14122B9F28A523C755E7BB9709C2E6D539FAA1020E101D46C9865D7D32C49CECF335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral5/memory/3412-0-0x00007FF8D4A90000-0x00007FF8D4B22000-memory.dmp	upx
behavioral5/memory/3412-8-0x00007FF8D4A90000-0x00007FF8D4B22000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\install.cfg	rundll32.exe
File opened for modification	C:\Program Files\Common Files\temp.key	rundll32.exe
File opened for modification	C:\Program Files\Common Files\teamspeak_control.bin	rundll32.exe
File opened for modification	C:\Program Files\Common Files\teamspeak_control.dll	rundll32.exe
File opened for modification	C:\Program Files\Common Files\444.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3412	rundll32.exe
3412	rundll32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\teamspeak_control.dll,#1
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3412-0-0x00007FF8D4A90000-0x00007FF8D4B22000-memory.dmp

Download

memory/3412-1-0x0000026DB0C10000-0x0000026DB0C11000-memory.dmp

Download

memory/3412-2-0x0000000180000000-0x000000018004B000-memory.dmp

Download

memory/3412-6-0x00007FF8E4250000-0x00007FF8E4445000-memory.dmp

Download

memory/3412-8-0x00007FF8D4A90000-0x00007FF8D4B22000-memory.dmp

Download