5e97b1088fb36b687c19f1661e43b13b9bebe233fe2543f66e8b2f8ab07b891b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Luxury Shield v18.9.0/DNGRTx86.dll
Size 1.2MB
Sample260808-jcfphsbn5t
SHA256 5e97b1088fb36b687c19f1661e43b13b9bebe233fe2543f66e8b2f8ab07b891b
MD5 a8a0481e38db76b75c4c61529e479b5f
SHA1 f2c406eb3799bac9def8a96acd9ca68b9f1f6ffb
SHA512 bfff222fae902dfac61e2cc36e34dacffeaaaae1c6a39e779c2f85f2ac956fda7e8f9e973e0b3773b2bbfa7ed1dd00e9d1fa4516cc50225a00fea1d6dd1cd09e
SSDEEP 24576:aDb02iQ069HOuZUTzao7PRTCB657SRBJP4YLhxdYqCrCmlRR2+Vr:2oo9uyOZPRTI69SRBJhhbYsml
TLSH
T1164533DB9A05A2D8D8F1A87DA7C5AD7386F8C08E4357D86E4942C9BD73320143B385BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4108	rundll32.exe
4108	rundll32.exe
4108	rundll32.exe
4108	rundll32.exe
4108	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	4108	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	rundll32.exe
4108	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4108	3416	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Luxury Shield v18.9.0\DNGRTx86.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Luxury Shield v18.9.0\DNGRTx86.dll",#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 780
    3⤵
    - Program crash
    PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4108 -ip 4108
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4108-0-0x0000000074FA0000-0x00000000753E0000-memory.dmp

Download

memory/4108-1-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download

memory/4108-2-0x0000000074FA0000-0x00000000753E0000-memory.dmp

Download