84cb61ac98670cc49f919940bc54461c00223ac74fc5b01581b450d89cfe5ab1

Analysis

max time kernel
299s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pdfcore8.dll
Size 5.5MB
Sample260815-denv1sysfs
SHA256 84cb61ac98670cc49f919940bc54461c00223ac74fc5b01581b450d89cfe5ab1
MD5 f168e1a06b5f8a380bd11edc5ecfc2b1
SHA1 fe4209bef744b93ac05d0b9d7e377e62dd6a1e5f
SHA512 3ed7b91952d04d9d117ce9ad14cd8b082412f10cdc41d83f8ca7e17a04955e9243ada87d3e02049f9b3d98e7cc55ed3b51b7062d3610707fe710c7a05be2f1f4
SSDEEP 98304:HZ450y5i1sSv66fjpSBRzPTq0+LToBoa+A7Z4OiZrq1DfPHNADtV6v+zM+rwroDH:HaT8iRzPTq0+QBFt7Z4O7NADtV6v+zZE
TLSH
T18146CF173E5C00A6E05A1133CEA9B6E8F1AEBDF83B76019715A0BB1DFD32741CA1456B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4216	rundll32.exe
7	4216	rundll32.exe
9	4216	rundll32.exe
11	4216	rundll32.exe
26	4216	rundll32.exe
28	4216	rundll32.exe
29	4216	rundll32.exe
30	4216	rundll32.exe
32	4216	rundll32.exe
41	4216	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
3980	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	api.ipify.org
9	api.ipify.org
29	api.ipify.org
31	icanhazip.com

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3464	tasklist.exe
4852	tasklist.exe
3644	tasklist.exe
3604	tasklist.exe
4632	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3116	cmd.exe
3444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
3584	timeout.exe
960	timeout.exe
2612	timeout.exe
908	timeout.exe
3492	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1504	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe
4216	rundll32.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	3464	tasklist.exe
Token: SeDebugPrivilege	4216	rundll32.exe
Token: SeLoadDriverPrivilege	4216	rundll32.exe
Token: SeTakeOwnershipPrivilege	4216	rundll32.exe
Token: SeIncBasePriorityPrivilege	4216	rundll32.exe
Token: SeTcbPrivilege	4216	rundll32.exe
Token: SeDebugPrivilege	4216	rundll32.exe
Token: SeCreateTokenPrivilege	4216	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	4216	rundll32.exe
Token: SeLockMemoryPrivilege	4216	rundll32.exe
Token: SeIncreaseQuotaPrivilege	4216	rundll32.exe
Token: SeMachineAccountPrivilege	4216	rundll32.exe
Token: SeTcbPrivilege	4216	rundll32.exe
Token: SeSecurityPrivilege	4216	rundll32.exe
Token: SeTakeOwnershipPrivilege	4216	rundll32.exe
Token: SeLoadDriverPrivilege	4216	rundll32.exe
Token: SeSystemProfilePrivilege	4216	rundll32.exe
Token: SeSystemtimePrivilege	4216	rundll32.exe
Token: SeProfSingleProcessPrivilege	4216	rundll32.exe
Token: SeIncBasePriorityPrivilege	4216	rundll32.exe
Token: SeCreatePagefilePrivilege	4216	rundll32.exe
Token: SeCreatePermanentPrivilege	4216	rundll32.exe
Token: SeBackupPrivilege	4216	rundll32.exe
Token: SeRestorePrivilege	4216	rundll32.exe
Token: SeShutdownPrivilege	4216	rundll32.exe
Token: SeDebugPrivilege	4216	rundll32.exe
Token: SeAuditPrivilege	4216	rundll32.exe
Token: SeSystemEnvironmentPrivilege	4216	rundll32.exe
Token: SeChangeNotifyPrivilege	4216	rundll32.exe
Token: SeRemoteShutdownPrivilege	4216	rundll32.exe
Token: SeUndockPrivilege	4216	rundll32.exe
Token: SeSyncAgentPrivilege	4216	rundll32.exe
Token: SeEnableDelegationPrivilege	4216	rundll32.exe
Token: SeManageVolumePrivilege	4216	rundll32.exe
Token: SeImpersonatePrivilege	4216	rundll32.exe
Token: SeCreateGlobalPrivilege	4216	rundll32.exe
Token: 31	4216	rundll32.exe
Token: 32	4216	rundll32.exe
Token: 33	4216	rundll32.exe
Token: 34	4216	rundll32.exe
Token: 35	4216	rundll32.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	3644	tasklist.exe
Token: SeDebugPrivilege	3604	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4216	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4216	2204	rundll32.exe	86
PID 4216 wrote to memory of 1504	4216	rundll32.exe	87
PID 4216 wrote to memory of 3444	4216	rundll32.exe	90
PID 3444 wrote to memory of 3116	3444	cmd.exe	92
PID 3116 wrote to memory of 3464	3116	cmd.exe	93
PID 3116 wrote to memory of 1440	3116	cmd.exe	94
PID 3116 wrote to memory of 3492	3116	cmd.exe	95
PID 3116 wrote to memory of 4852	3116	cmd.exe	106
PID 3116 wrote to memory of 4308	3116	cmd.exe	107
PID 3116 wrote to memory of 3584	3116	cmd.exe	108
PID 3116 wrote to memory of 3644	3116	cmd.exe	109
PID 3116 wrote to memory of 4164	3116	cmd.exe	110
PID 3116 wrote to memory of 960	3116	cmd.exe	111
PID 3116 wrote to memory of 3604	3116	cmd.exe	112
PID 3116 wrote to memory of 1144	3116	cmd.exe	113
PID 3116 wrote to memory of 2612	3116	cmd.exe	114
PID 3116 wrote to memory of 4632	3116	cmd.exe	115
PID 3116 wrote to memory of 728	3116	cmd.exe	116
PID 3116 wrote to memory of 908	3116	cmd.exe	117

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pdfcore8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pdfcore8.dll,#1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3464
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3492
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3584
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3644
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:960
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3604
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2612
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4632
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:728
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:908

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BC2411DEE9DC.CMD

Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
Size 1KB
SHA256 6d97e618b6488511ba41105d41f06d4a60fe6de7ed723840b47898ae0e4efbc1
MD5 13691cf5a54401dfdcb83241ad3a59c4
SHA1 f853624ce91b651a8e9152e625fb5cb6c90a6671
SHA512 5c0a4bdc50fa41a249cb375b5f65832fc8db135f92d481b9bea4758e3b37a6782b2cf13e678f4a5d41442b02652440f08d893b82b8ebaa900911ac38feaba82a
TLSH
T17531D79EC4470E1D431442EB22AA8C9FC680E047FE9530D0B9D89B8123C5A8E08A6BAD
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
TLSH
T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4216-8-0x0000000003EA0000-0x0000000003EF3000-memory.dmp

Download

memory/4216-10-0x0000000004080000-0x00000000040D8000-memory.dmp

Download

memory/4216-11-0x0000000004080000-0x00000000040D8000-memory.dmp

Download

memory/4216-13-0x0000000004080000-0x00000000040D8000-memory.dmp

Download

memory/4216-15-0x0000000004080000-0x00000000040D8000-memory.dmp

Download

memory/4216-14-0x0000000004080000-0x00000000040D8000-memory.dmp

Download

memory/4216-17-0x0000000004080000-0x00000000040D8000-memory.dmp

Download