Analysis
- user interaction
yes - max time kernel
448s - max time network
405s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 02:54
General
- Target DDLC-1.1.1-pc/DDLC.exe
- Size 377KB
- Sample260808-dd85kabc98
- SHA256 0f9ec1aede2a8397c23801200df606bf03e400fbd09b32f762c33f37a9137085
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DDLC-1.1.1-pc\DDLC.exe"C:\Users\Admin\AppData\Local\Temp\DDLC-1.1.1-pc\DDLC.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DDLC-1.1.1-pc\lib\windows-i686\DDLC.exe"C:\\Users\\Admin\\AppData\\Local\\Temp\\DDLC-1.1.1-pc\\lib\\windows-i686\\DDLC.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "wmic process get Description"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic process get Description4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3340-1-0x000000006C810000-0x000000006C811000-memory.dmp
memory/3340-8-0x0000000000EA0000-0x0000000000EFB000-memory.dmp
memory/3340-108-0x0000000003C70000-0x0000000003C7E000-memory.dmp
memory/3340-116-0x0000000000400000-0x0000000000464000-memory.dmp
memory/3340-124-0x00000000658C0000-0x00000000658E3000-memory.dmp
memory/3340-159-0x00000000682C0000-0x00000000682D0000-memory.dmp
memory/3340-158-0x0000000061500000-0x000000006152B000-memory.dmp
memory/3340-157-0x0000000067400000-0x000000006744E000-memory.dmp
memory/3340-156-0x000000006ED80000-0x000000006EDE1000-memory.dmp
memory/3340-155-0x0000000069A80000-0x0000000069AEA000-memory.dmp
memory/3340-154-0x0000000065240000-0x0000000065257000-memory.dmp
memory/3340-153-0x0000000070CC0000-0x0000000070CD9000-memory.dmp
memory/3340-152-0x000000006A600000-0x000000006A618000-memory.dmp
memory/3340-151-0x000000006D940000-0x000000006D958000-memory.dmp
memory/3340-150-0x0000000065500000-0x0000000065518000-memory.dmp
memory/3340-149-0x0000000061580000-0x0000000061596000-memory.dmp
memory/3340-148-0x0000000065BC0000-0x0000000065BDE000-memory.dmp
memory/3340-147-0x000000006DA40000-0x000000006DA4E000-memory.dmp
memory/3340-146-0x0000000067E00000-0x0000000067E34000-memory.dmp
memory/3340-145-0x000000006F240000-0x000000006F266000-memory.dmp
memory/3340-144-0x0000000068640000-0x000000006864F000-memory.dmp
memory/3340-143-0x0000000069000000-0x0000000069017000-memory.dmp
memory/3340-142-0x000000006F2C0000-0x000000006F2CE000-memory.dmp
memory/3340-141-0x00000000621C0000-0x00000000621D1000-memory.dmp
memory/3340-140-0x0000000000EA0000-0x0000000000EFB000-memory.dmp
memory/3340-139-0x000000006A880000-0x000000006A8C3000-memory.dmp
memory/3340-138-0x000000006BC80000-0x000000006BCAE000-memory.dmp
memory/3340-137-0x0000000062600000-0x0000000062614000-memory.dmp
memory/3340-136-0x0000000062E80000-0x0000000062EA0000-memory.dmp
memory/3340-135-0x0000000070D80000-0x0000000070E06000-memory.dmp
memory/3340-134-0x0000000071000000-0x000000007100F000-memory.dmp
memory/3340-133-0x0000000067040000-0x0000000067055000-memory.dmp
memory/3340-132-0x0000000062C00000-0x0000000062C2E000-memory.dmp
memory/3340-131-0x0000000067000000-0x000000006701E000-memory.dmp
memory/3340-130-0x0000000066FC0000-0x0000000066FD6000-memory.dmp
memory/3340-129-0x0000000071140000-0x0000000071153000-memory.dmp
memory/3340-128-0x0000000061A00000-0x0000000061A15000-memory.dmp
memory/3340-127-0x0000000069500000-0x0000000069511000-memory.dmp
memory/3340-126-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-125-0x0000000065F00000-0x0000000065F2A000-memory.dmp
memory/3340-123-0x000000006C6C0000-0x000000006C6E5000-memory.dmp
memory/3340-118-0x000000006CEC0000-0x000000006CEDB000-memory.dmp
memory/3340-122-0x0000000062780000-0x00000000627CB000-memory.dmp
memory/3340-121-0x0000000067100000-0x0000000067147000-memory.dmp
memory/3340-120-0x00000000625C0000-0x00000000625CF000-memory.dmp
memory/3340-119-0x0000000064940000-0x0000000064954000-memory.dmp
memory/3340-117-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-169-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-197-0x000000006F240000-0x000000006F266000-memory.dmp
memory/3340-178-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-236-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-227-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-288-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-279-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-337-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-328-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-381-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-372-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-425-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-416-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-469-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-460-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3340-513-0x00000000647C0000-0x00000000647EC000-memory.dmp
memory/3340-504-0x000000006C740000-0x000000006C81C000-memory.dmp
memory/3364-0-0x0000000000400000-0x0000000000464000-memory.dmp