Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DB79946F96CBBD47E4782DCDD737A66E.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
DB79946F96CBBD47E4782DCDD737A66E.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target DB79946F96CBBD47E4782DCDD737A66E.dll
- Size 5.8MB
- Sample260817-ftw62stdkb
- SHA256 cf8917e255209f5362b852ad019d53b21b9325df27eb7ef3d7e2d507776d2afe
- MD5 db79946f96cbbd47e4782dcdd737a66e
- SHA1 1927da919377e0d88363326973a97fbd32c7eeec
- SHA512 6913f0e830f25b00acba4fe59c16ac6a73f58897ce8b78302ecc39d41025d23b8ec164a1f80fcabcc78280b00e626c7b9f4b3e05e8469fa65485096cdc522252
- SSDEEP 98304:dslOw/acVlIX6iTfjHCQCazaDkrAFXDxzSvZ4OiZrq1DfPHNADtV6v+zM+rwroD9:dss5UalCazaPJtOvZ4O7NADtV6v+zZRR
- TLSH T11256D0123C5C1066E41A0330DE69A2FCF6BE6C663B30D29711A0F6BDED71B425A546FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 11 952 rundll32.exe 12 952 rundll32.exe 20 952 rundll32.exe 27 952 rundll32.exe 31 952 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 412 rundll32.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\Z: rundll32.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 api.ipify.org 26 icanhazip.com - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1284 tasklist.exe 3964 tasklist.exe 2716 tasklist.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2068 cmd.exe 4460 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe - Delays execution with timeout.exe 3 IoCs
pid Process 1160 timeout.exe 1332 timeout.exe 3288 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 4900 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe 952 rundll32.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4900 taskkill.exe Token: SeDebugPrivilege 1284 tasklist.exe Token: SeDebugPrivilege 952 rundll32.exe Token: SeLoadDriverPrivilege 952 rundll32.exe Token: SeTakeOwnershipPrivilege 952 rundll32.exe Token: SeIncBasePriorityPrivilege 952 rundll32.exe Token: SeTcbPrivilege 952 rundll32.exe Token: SeDebugPrivilege 952 rundll32.exe Token: SeCreateTokenPrivilege 952 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 952 rundll32.exe Token: SeLockMemoryPrivilege 952 rundll32.exe Token: SeIncreaseQuotaPrivilege 952 rundll32.exe Token: SeMachineAccountPrivilege 952 rundll32.exe Token: SeTcbPrivilege 952 rundll32.exe Token: SeSecurityPrivilege 952 rundll32.exe Token: SeTakeOwnershipPrivilege 952 rundll32.exe Token: SeLoadDriverPrivilege 952 rundll32.exe Token: SeSystemProfilePrivilege 952 rundll32.exe Token: SeSystemtimePrivilege 952 rundll32.exe Token: SeProfSingleProcessPrivilege 952 rundll32.exe Token: SeIncBasePriorityPrivilege 952 rundll32.exe Token: SeCreatePagefilePrivilege 952 rundll32.exe Token: SeCreatePermanentPrivilege 952 rundll32.exe Token: SeBackupPrivilege 952 rundll32.exe Token: SeRestorePrivilege 952 rundll32.exe Token: SeShutdownPrivilege 952 rundll32.exe Token: SeDebugPrivilege 952 rundll32.exe Token: SeAuditPrivilege 952 rundll32.exe Token: SeSystemEnvironmentPrivilege 952 rundll32.exe Token: SeChangeNotifyPrivilege 952 rundll32.exe Token: SeRemoteShutdownPrivilege 952 rundll32.exe Token: SeUndockPrivilege 952 rundll32.exe Token: SeSyncAgentPrivilege 952 rundll32.exe Token: SeEnableDelegationPrivilege 952 rundll32.exe Token: SeManageVolumePrivilege 952 rundll32.exe Token: SeImpersonatePrivilege 952 rundll32.exe Token: SeCreateGlobalPrivilege 952 rundll32.exe Token: 31 952 rundll32.exe Token: 32 952 rundll32.exe Token: 33 952 rundll32.exe Token: 34 952 rundll32.exe Token: 35 952 rundll32.exe Token: SeDebugPrivilege 3964 tasklist.exe Token: SeDebugPrivilege 2716 tasklist.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 952 rundll32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3168 wrote to memory of 952 3168 rundll32.exe 85 PID 952 wrote to memory of 4900 952 rundll32.exe 87 PID 952 wrote to memory of 4460 952 rundll32.exe 90 PID 4460 wrote to memory of 2068 4460 cmd.exe 92 PID 2068 wrote to memory of 1284 2068 cmd.exe 93 PID 2068 wrote to memory of 1972 2068 cmd.exe 94 PID 2068 wrote to memory of 3288 2068 cmd.exe 95 PID 2068 wrote to memory of 3964 2068 cmd.exe 111 PID 2068 wrote to memory of 3208 2068 cmd.exe 112 PID 2068 wrote to memory of 1160 2068 cmd.exe 113 PID 2068 wrote to memory of 2716 2068 cmd.exe 114 PID 2068 wrote to memory of 4464 2068 cmd.exe 115 PID 2068 wrote to memory of 1332 2068 cmd.exe 116
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DB79946F96CBBD47E4782DCDD737A66E.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DB79946F96CBBD47E4782DCDD737A66E.dll,#12⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3288
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3208
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1160
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4464
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1332
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 eea43c0333d81e29199580530722d905eb34d25f2fd78135140a62156f98e094
- MD5 f25a4c310f12cc3d9485cd606aa9d1d5
- SHA1 4d0199350bbfb07efd8a619255eddac01d026382
- SHA512 30aaaffe8e3f6d02c89f73c13bbfe86bea0518c79367343ea00e5df840bd588fe12f6e153664b953d82810b653b87250e3003da6e5a86979f361e3209acb89cd
- TLSH T14E311B9FC4174E1D435402EF178ACC9FC680E003EE847190B5D89B803385A9E18A6BEE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\rundll32.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH