30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531.exe
Size 214KB
Sample260804-ynfafsga87
SHA256 30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531
MD5 7eb385f36193b412b9e7f339e652fb58
SHA1 28000049986ca22d3dc2e1072bef73b8cd980d70
SHA512 7fd03ec10dd426b4e0564058edb97baf224fed78ee766a36bc99730360fb94295a8bd2e7114e20623544d4eef4a0de53c59129db19b616d4963665962910870f
SSDEEP 3072:BqAl5Gz2Uv48KYxPRdFfh7xseVmFknX4a7WClPTenyJ3OYIYCxQ08xp68fIxTp:5lcz2hCjnZw/UWebKBYQknI
TLSH
T104248CA72EB4F5F6F136213D4910814887217C35DED1DB8F83A58B522E736938DBAA31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4492	rundll32.exe
2	4492	rundll32.exe
2	4492	rundll32.exe
2	4492	rundll32.exe
2	4492	rundll32.exe
2	4492	rundll32.exe
2	4492	rundll32.exe
2	4492	rundll32.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FdpMon\Parameters\ServiceDll = "C:\\Users\\Public\\Documents\\udv8sa.dll"	30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531.exe

Loads dropped DLL 2 IoCs

pid	Process
4120	svchost.exe
4492	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3412	PING.EXE
3004	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3412	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3004	3680	30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531.exe	90
PID 3004 wrote to memory of 3412	3004	cmd.exe	92
PID 4120 wrote to memory of 4492	4120	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531.exe
"C:\Users\Admin\AppData\Local\Temp\30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\system32\cmd.exe
  /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "FdpMon" -s FdpMon
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\System32\rundll32.exe
  rundll32 "c:\users\public\documents\udv8sa.dll",LoadPayload
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  PID:4492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "FdpMon"
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

udv8sa.bin

Path \??\c:\users\public\documents\udv8sa.bin
Size 1KB
SHA256 7eb29f21fdb62caf110d6bac63e1e14c4431395125ac62d29ec0b3d373940efe
MD5 53f256922aaac8008a8c1f420dff9a1d
SHA1 49ae48a7f394185f0c834ea5761aa43906a89f80
SHA512 5ed52112f682eaaab0cf44bcb20c10806e732bce5c18d52b6ce3404f22a1930d5527b16c5df7419e919eb20bbca5b0689ce4b5e90f05a308f7bd7fba729ad04e
TLSH
T15E21860BC1E03663D9665E3C8A83883BAF23B4D37BD44C72D7A016081AA8E9614ED381
MD5 SHA1 SHA512 TLSH

Submit Download

udv8sa.dll

Path \??\c:\users\public\documents\udv8sa.dll
Size 102KB
SHA256 5d441cba72492e7ba3a22cb7a2f204f96fdeca13643e5ce46dfca5f2c2d1a844
MD5 202d5db612237e0ee1870f6f2344a1cb
SHA1 a1fc65c49f6918522460ed3cb121c8aede73e3fb
SHA512 0e94ab5c3f46a865c18599ff6d8e5fb49c832b501d7b2336c723ed1cf629d11080014e465d2361a590f3f224a301d37269c0fdd04a14acabe1c9e73881020e1c
SSDEEP 3072:CLNJik31HSKf8I3WS2UCtAdt0d91VJQMvsb3n:CqklHnf5l2UCK
TLSH
T104A34A5B63A540BBE1778678C4A34A4AD772F8510771ABFF43A4068A1F273D18D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH