Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 12:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
server.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
server.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target server.dll
- Size 1.4MB
- Sample260816-pp3byadc66
- SHA256 8ae68cc5c858a8a0645bc0a8874f86c422287a4cab9f9aa0e3a38b5cbc414dd9
- MD5 1289d1fe6c3a6948f42cd1f50f1d88f9
- SHA1 ce2a3e27534fa3441def3d12e1e80a71f4cdf0c2
- SHA512 6ee3855f54baefd3de682562b7be9be5d093ebc4d06501fa92f9bc14ab4082507e7e5c630d7d93e031b7c946373d3a5425f3b0dd614e88f0b3ee6c76f14ae515
- SSDEEP 24576:aGuDman1gRHVmq8/2RVQUBfRh2/8WXioFpc4B8AU7f/2yzCncZZD15U:DuDVn1KV0/2LQ8W/89oF5fi/2yen
- TLSH T199659E46A3F401A8D1B7C278C6579A1FD772780503609BDF2BE44B6A6F23BE05B3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4720 regsvr32.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2552 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 WMIC.exe 4864 WMIC.exe 4864 WMIC.exe 4864 WMIC.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe 4720 regsvr32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4720 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4864 WMIC.exe Token: SeSecurityPrivilege 4864 WMIC.exe Token: SeTakeOwnershipPrivilege 4864 WMIC.exe Token: SeLoadDriverPrivilege 4864 WMIC.exe Token: SeSystemProfilePrivilege 4864 WMIC.exe Token: SeSystemtimePrivilege 4864 WMIC.exe Token: SeProfSingleProcessPrivilege 4864 WMIC.exe Token: SeIncBasePriorityPrivilege 4864 WMIC.exe Token: SeCreatePagefilePrivilege 4864 WMIC.exe Token: SeBackupPrivilege 4864 WMIC.exe Token: SeRestorePrivilege 4864 WMIC.exe Token: SeShutdownPrivilege 4864 WMIC.exe Token: SeDebugPrivilege 4864 WMIC.exe Token: SeSystemEnvironmentPrivilege 4864 WMIC.exe Token: SeRemoteShutdownPrivilege 4864 WMIC.exe Token: SeUndockPrivilege 4864 WMIC.exe Token: SeManageVolumePrivilege 4864 WMIC.exe Token: 33 4864 WMIC.exe Token: 34 4864 WMIC.exe Token: 35 4864 WMIC.exe Token: 36 4864 WMIC.exe Token: SeIncreaseQuotaPrivilege 4864 WMIC.exe Token: SeSecurityPrivilege 4864 WMIC.exe Token: SeTakeOwnershipPrivilege 4864 WMIC.exe Token: SeLoadDriverPrivilege 4864 WMIC.exe Token: SeSystemProfilePrivilege 4864 WMIC.exe Token: SeSystemtimePrivilege 4864 WMIC.exe Token: SeProfSingleProcessPrivilege 4864 WMIC.exe Token: SeIncBasePriorityPrivilege 4864 WMIC.exe Token: SeCreatePagefilePrivilege 4864 WMIC.exe Token: SeBackupPrivilege 4864 WMIC.exe Token: SeRestorePrivilege 4864 WMIC.exe Token: SeShutdownPrivilege 4864 WMIC.exe Token: SeDebugPrivilege 4864 WMIC.exe Token: SeSystemEnvironmentPrivilege 4864 WMIC.exe Token: SeRemoteShutdownPrivilege 4864 WMIC.exe Token: SeUndockPrivilege 4864 WMIC.exe Token: SeManageVolumePrivilege 4864 WMIC.exe Token: 33 4864 WMIC.exe Token: 34 4864 WMIC.exe Token: 35 4864 WMIC.exe Token: 36 4864 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4720 regsvr32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4720 wrote to memory of 2552 4720 regsvr32.exe 88 PID 2552 wrote to memory of 4864 2552 cmd.exe 90
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\server.dll1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get uuid2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-