Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 15:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
server.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
server.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target server.dll
- Size 1.4MB
- Sample260816-sh1fjsdm21
- SHA256 8ae68cc5c858a8a0645bc0a8874f86c422287a4cab9f9aa0e3a38b5cbc414dd9
- MD5 1289d1fe6c3a6948f42cd1f50f1d88f9
- SHA1 ce2a3e27534fa3441def3d12e1e80a71f4cdf0c2
- SHA512 6ee3855f54baefd3de682562b7be9be5d093ebc4d06501fa92f9bc14ab4082507e7e5c630d7d93e031b7c946373d3a5425f3b0dd614e88f0b3ee6c76f14ae515
- SSDEEP 24576:aGuDman1gRHVmq8/2RVQUBfRh2/8WXioFpc4B8AU7f/2yzCncZZD15U:DuDVn1KV0/2LQ8W/89oF5fi/2yen
- TLSH T199659E46A3F401A8D1B7C278C6579A1FD772780503609BDF2BE44B6A6F23BE05B3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4316 regsvr32.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3328 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3592 WMIC.exe 3592 WMIC.exe 3592 WMIC.exe 3592 WMIC.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe 4316 regsvr32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4316 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3592 WMIC.exe Token: SeSecurityPrivilege 3592 WMIC.exe Token: SeTakeOwnershipPrivilege 3592 WMIC.exe Token: SeLoadDriverPrivilege 3592 WMIC.exe Token: SeSystemProfilePrivilege 3592 WMIC.exe Token: SeSystemtimePrivilege 3592 WMIC.exe Token: SeProfSingleProcessPrivilege 3592 WMIC.exe Token: SeIncBasePriorityPrivilege 3592 WMIC.exe Token: SeCreatePagefilePrivilege 3592 WMIC.exe Token: SeBackupPrivilege 3592 WMIC.exe Token: SeRestorePrivilege 3592 WMIC.exe Token: SeShutdownPrivilege 3592 WMIC.exe Token: SeDebugPrivilege 3592 WMIC.exe Token: SeSystemEnvironmentPrivilege 3592 WMIC.exe Token: SeRemoteShutdownPrivilege 3592 WMIC.exe Token: SeUndockPrivilege 3592 WMIC.exe Token: SeManageVolumePrivilege 3592 WMIC.exe Token: 33 3592 WMIC.exe Token: 34 3592 WMIC.exe Token: 35 3592 WMIC.exe Token: 36 3592 WMIC.exe Token: SeIncreaseQuotaPrivilege 3592 WMIC.exe Token: SeSecurityPrivilege 3592 WMIC.exe Token: SeTakeOwnershipPrivilege 3592 WMIC.exe Token: SeLoadDriverPrivilege 3592 WMIC.exe Token: SeSystemProfilePrivilege 3592 WMIC.exe Token: SeSystemtimePrivilege 3592 WMIC.exe Token: SeProfSingleProcessPrivilege 3592 WMIC.exe Token: SeIncBasePriorityPrivilege 3592 WMIC.exe Token: SeCreatePagefilePrivilege 3592 WMIC.exe Token: SeBackupPrivilege 3592 WMIC.exe Token: SeRestorePrivilege 3592 WMIC.exe Token: SeShutdownPrivilege 3592 WMIC.exe Token: SeDebugPrivilege 3592 WMIC.exe Token: SeSystemEnvironmentPrivilege 3592 WMIC.exe Token: SeRemoteShutdownPrivilege 3592 WMIC.exe Token: SeUndockPrivilege 3592 WMIC.exe Token: SeManageVolumePrivilege 3592 WMIC.exe Token: 33 3592 WMIC.exe Token: 34 3592 WMIC.exe Token: 35 3592 WMIC.exe Token: 36 3592 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4316 regsvr32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4316 wrote to memory of 3328 4316 regsvr32.exe 89 PID 3328 wrote to memory of 3592 3328 cmd.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\server.dll1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get uuid2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-