Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 10:24
General
- Target cac6bf9f320911cb8d77dae00e0479484d33dbaae56eb757c22545c8f79f28fb.dll
- Size 889KB
- Sample260802-mfrsqsgp3t
- SHA256 cac6bf9f320911cb8d77dae00e0479484d33dbaae56eb757c22545c8f79f28fb
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cac6bf9f320911cb8d77dae00e0479484d33dbaae56eb757c22545c8f79f28fb.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cac6bf9f320911cb8d77dae00e0479484d33dbaae56eb757c22545c8f79f28fb.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4584-6-0x0000000075280000-0x00000000754B4000-memory.dmp
memory/4584-0-0x0000000075280000-0x00000000754B4000-memory.dmp
memory/4584-5-0x00000000754B1000-0x00000000754B2000-memory.dmp
memory/4584-16-0x0000000001F80000-0x0000000001F81000-memory.dmp
memory/4584-22-0x0000000002330000-0x0000000002331000-memory.dmp
memory/4584-30-0x0000000002520000-0x0000000002521000-memory.dmp
memory/4584-29-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4584-28-0x0000000002500000-0x0000000002501000-memory.dmp
memory/4584-31-0x0000000075280000-0x00000000754B4000-memory.dmp
memory/4584-27-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4584-26-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/4584-25-0x0000000002360000-0x0000000002361000-memory.dmp
memory/4584-24-0x0000000002350000-0x0000000002351000-memory.dmp
memory/4584-23-0x0000000002340000-0x0000000002341000-memory.dmp
memory/4584-21-0x0000000002320000-0x0000000002321000-memory.dmp
memory/4584-20-0x0000000002310000-0x0000000002311000-memory.dmp
memory/4584-32-0x0000000075280000-0x00000000754B4000-memory.dmp
memory/4584-19-0x0000000002080000-0x0000000002081000-memory.dmp
memory/4584-18-0x0000000002070000-0x0000000002071000-memory.dmp
memory/4584-17-0x0000000002060000-0x0000000002061000-memory.dmp
memory/4584-15-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4584-14-0x0000000000790000-0x0000000000791000-memory.dmp
memory/4584-13-0x0000000000780000-0x0000000000781000-memory.dmp
memory/4584-7-0x0000000002370000-0x00000000023D1000-memory.dmp
memory/4584-33-0x0000000075280000-0x00000000754B4000-memory.dmp