Analysis
- max time kernel
252s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
384134f55cfdf153230fad2129cc2a5959433c3a/client-resources-384134f55cfdf153230fad2129cc2a5959433c3a/bin/win64/xldr.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
384134f55cfdf153230fad2129cc2a5959433c3a/client-resources-384134f55cfdf153230fad2129cc2a5959433c3a/bin/win64/xldr.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
384134f55cfdf153230fad2129cc2a5959433c3a/client-resources-384134f55cfdf153230fad2129cc2a5959433c3a/cs2/vpks/game.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
384134f55cfdf153230fad2129cc2a5959433c3a/client-resources-384134f55cfdf153230fad2129cc2a5959433c3a/cs2/vpks/game.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023.exe
Resource
win11ltsc2024-20260709-en
General
- Target 384134f55cfdf153230fad2129cc2a5959433c3a/client-resources-384134f55cfdf153230fad2129cc2a5959433c3a/bin/win64/xldr.dll
- Size 5.7MB
- Sample260806-de86ysxtgz
- SHA256 2b5b2f22a962e65e04b710ba401d480dac5f882234620ee1e74b620ddb5deaff
- MD5 782e90be6f69557abfb80f0061f07d16
- SHA1 2c45e6390e814417e8f0d3dc1c1a00d352ded1a3
- SHA512 1542e60fdf6b52db397efdea656ebe4d79440c5a23c85d8ffb6c80d9a496f39abc3b0e92ddcc9fa23f3fcfff1c38470d37834dfb8900816c43a04d4522743530
- SSDEEP 98304:qU8fS/FU4FFPBLcGlTwYxEuuBEzn6N0dk7orTR4fPMtWLQ5i8140ch:ppF9xcWV4Eb6N7kxWLQ5c
- TLSH T1B056238078D616B0C6878A33D1852EFAFC4134C17D7B9A0F5FE2295C2971D16DEA2F29
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1288 rundll32.exe 1288 rundll32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1288 rundll32.exe 1288 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\384134f55cfdf153230fad2129cc2a5959433c3a\client-resources-384134f55cfdf153230fad2129cc2a5959433c3a\bin\win64\xldr.dll,#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1288