b4dfb2b3cf5bfa574191e3c9ac50394fa5be19fe921141c13b842d3552f7bc3d

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4dfb2b3cf5bfa574191e3c9ac50394fa5be19fe921141c13b842d3552f7bc3d.dll
Size 5.5MB
Sample260813-tmpehstdrb
SHA256 b4dfb2b3cf5bfa574191e3c9ac50394fa5be19fe921141c13b842d3552f7bc3d
MD5 01a422f905a987871e5aa39d09e796a3
SHA1 551a8d1afe3814402a374b924e46e6bffbb62358
SHA512 6e68b968ea39025871bd088fdb99a67f20dfe783023d2a434d661e9427679a55df92ddecbcedcbe1fec6d9d9771e20c9f35aed377afc374e59205e567a325852
SSDEEP 98304:HZ450y5i1sSv66fjpSBRzPTq0TLToBoa+A7Z4OiZrq1DfPHNADtV6v+zM+rwroDH:HaT8iRzPTq0TQBFt7Z4O7NADtV6v+zZE
TLSH
T10F46CF173E5C00A6E05A1133CEA9B6E8F1AEBDF83B76019715A0BB1DFD32741CA1456B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 38 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	6032	rundll32.exe
9	6032	rundll32.exe
10	6032	rundll32.exe
11	6032	rundll32.exe
12	6032	rundll32.exe
13	6032	rundll32.exe
14	6032	rundll32.exe
15	6032	rundll32.exe
16	6032	rundll32.exe
17	6032	rundll32.exe
18	6032	rundll32.exe
19	6032	rundll32.exe
20	6032	rundll32.exe
21	6032	rundll32.exe
23	6032	rundll32.exe
24	6032	rundll32.exe
25	6032	rundll32.exe
26	6032	rundll32.exe
27	6032	rundll32.exe
28	6032	rundll32.exe
29	6032	rundll32.exe
30	6032	rundll32.exe
31	6032	rundll32.exe
32	6032	rundll32.exe
33	6032	rundll32.exe
34	6032	rundll32.exe
35	6032	rundll32.exe
36	6032	rundll32.exe
37	6032	rundll32.exe
38	6032	rundll32.exe
39	6032	rundll32.exe
40	6032	rundll32.exe
41	6032	rundll32.exe
42	6032	rundll32.exe
43	6032	rundll32.exe
44	6032	rundll32.exe
45	6032	rundll32.exe
46	6032	rundll32.exe

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3948	tasklist.exe
5988	tasklist.exe
5592	tasklist.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe
1668	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2376	timeout.exe
3448	timeout.exe
4964	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5292	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe
6032	rundll32.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5292	taskkill.exe
Token: SeDebugPrivilege	5592	tasklist.exe
Token: SeDebugPrivilege	6032	rundll32.exe
Token: SeLoadDriverPrivilege	6032	rundll32.exe
Token: SeTakeOwnershipPrivilege	6032	rundll32.exe
Token: SeIncBasePriorityPrivilege	6032	rundll32.exe
Token: SeTcbPrivilege	6032	rundll32.exe
Token: SeDebugPrivilege	3948	tasklist.exe
Token: SeDebugPrivilege	5988	tasklist.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 6032	3576	rundll32.exe	89
PID 6032 wrote to memory of 5292	6032	rundll32.exe	90
PID 6032 wrote to memory of 4688	6032	rundll32.exe	93
PID 4688 wrote to memory of 1668	4688	cmd.exe	95
PID 1668 wrote to memory of 5592	1668	cmd.exe	96
PID 1668 wrote to memory of 3332	1668	cmd.exe	97
PID 1668 wrote to memory of 2376	1668	cmd.exe	98
PID 1668 wrote to memory of 3948	1668	cmd.exe	100
PID 1668 wrote to memory of 2660	1668	cmd.exe	101
PID 1668 wrote to memory of 3448	1668	cmd.exe	102
PID 1668 wrote to memory of 5988	1668	cmd.exe	103
PID 1668 wrote to memory of 5612	1668	cmd.exe	104
PID 1668 wrote to memory of 4964	1668	cmd.exe	105

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4dfb2b3cf5bfa574191e3c9ac50394fa5be19fe921141c13b842d3552f7bc3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4dfb2b3cf5bfa574191e3c9ac50394fa5be19fe921141c13b842d3552f7bc3d.dll,#1
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5592
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3332
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2376
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3448
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BC2411DEE9DC.CMD

Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
Size 1KB
SHA256 3ac5a63cc8e37d45089e588aa817595b3bf34521e0f269aaa98d2d846d4bcbd8
MD5 27d7a89aec12e653e1684fc53dc8e13e
SHA1 b0ea182e38615365023c0a3da783541d82838fcc
SHA512 6f9d91c9e5ee495f17f56a6ea85e724fc32c59bb975b2a9281c205c49eb66a604f4efe26409a054c668914471a1a30d939427fc63f45389e946b89c852c5a7cc
TLSH
T18931104EC4070E1D031142DF1286CC5FC640E00BFE853090B5EC9B8123C594E09A9BED
MD5 SHA1 SHA512 TLSH

Submit Download