3c3cb23772aed76adaf79de75604e00720832965677b4f5a7d69423bc9d299b9

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c3cb23772aed76adaf79de75604e00720832965677b4f5a7d69423bc9d299b9.dll
Size 1.9MB
Sample260804-ymm9nsga72
SHA256 3c3cb23772aed76adaf79de75604e00720832965677b4f5a7d69423bc9d299b9
MD5 5d7faaefb024859745b6cf9458c86114
SHA1 6b14d707fdc9378a878235d5123a739f1bc860c1
SHA512 f34ae82bce3d2917bb0104c0f1dd91657b98a53f852340759b3b99acf5b81164d3dc43f1837e24a1e50c7219f4c6d29fc7af16184374f35b1666cc0c666a453f
SSDEEP 24576:aTt1qLUNdChVBAjMa3k3e9gnvxnkZmrO11lNBT8y5uAiR7hYG2z:aT3qQNdy4Wt5nNav8mbVV
TLSH
T108956A06A3A5EE6BC85BE73951CB6706B770FC502763ABC7121016392E577CA9D3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4924	IdTymPe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\8IdTym = "C:\\Windows\\system32\\rundll32.exe"	IdTymPe.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IdTymPe.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c3cb23772aed76adaf79de75604e00720832965677b4f5a7d69423bc9d299b9.dll,#1
1⤵
- Drops file in System32 directory
PID:2892

C:\Users\Admin\AppData\Local\Temp\IdTymPe.exe
"C:\Users\Admin\AppData\Local\Temp\IdTymPe.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4924

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IdTymPe.exe

Path C:\Users\Admin\AppData\Local\Temp\IdTymPe.exe
Size 28KB
SHA256 237e36e4cfbbe9de370c1ea3d9a7aa982883d9b50e443f52c8fd801a456a09b7
MD5 561250254c98392c989a0bd4de1d59bb
SHA1 c97467df076468aedd707116f3a5861af217006b
SHA512 1a50f756c845a68c80f356ddc9c0a190665eb1ad6409eb0fe8edbcf81e18ef9bf7867a2876eeceec51dfc70f67c7dd7d1d8a2aef14084936a90aee3012ea3a61
SSDEEP 384:54RtNW11mlDgMTmfSpgHkEGeawMRMRyOzvZsDNyD8MExbEooxi:+RrW1QmfLHzG4MRMRBDcN08M4bnox
TLSH
T17BD27C37BCF24073C452C5B120B14F5E677F26620E63A943EB546A5A3F316D0ED2A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

regsetup.txt

Path C:\Users\Admin\AppData\Local\Temp\regsetup.txt
Size 156B
SHA256 677879fd9a866a9bf61beeba11f5aef9c0440f99c520671e46864e28aeff0165
MD5 bb2b6e53006fbf15a98e96fdf7d8a248
SHA1 540c0748b822b93d3ef84ff9f79c147e89952af8
SHA512 9c70b54aca94fdf13d5054a5067f0802a86bbba9f3eb59e576f57f3d9e988aa28ec0c829e55e60154bc17b2c491574530e74e0a61278e3a4838d88c743bfdac4
TLSH
T12EC08C8164206032B2E06A24080A17A30BA2B3EE3B0A89A8048491D0B84168E4326AF6
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads