Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DB79946F96CBBD47E4782DCDD737A66E.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
DB79946F96CBBD47E4782DCDD737A66E.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target DB79946F96CBBD47E4782DCDD737A66E.dll
- Size 5.8MB
- Sample260817-ftw62stdkb
- SHA256 cf8917e255209f5362b852ad019d53b21b9325df27eb7ef3d7e2d507776d2afe
- MD5 db79946f96cbbd47e4782dcdd737a66e
- SHA1 1927da919377e0d88363326973a97fbd32c7eeec
- SHA512 6913f0e830f25b00acba4fe59c16ac6a73f58897ce8b78302ecc39d41025d23b8ec164a1f80fcabcc78280b00e626c7b9f4b3e05e8469fa65485096cdc522252
- SSDEEP 98304:dslOw/acVlIX6iTfjHCQCazaDkrAFXDxzSvZ4OiZrq1DfPHNADtV6v+zM+rwroD9:dss5UalCazaPJtOvZ4O7NADtV6v+zZRR
- TLSH T11256D0123C5C1066E41A0330DE69A2FCF6BE6C663B30D29711A0F6BDED71B425A546FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 2900 rundll32.exe 9 2900 rundll32.exe 10 2900 rundll32.exe 11 2900 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 2448 rundll32.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 10 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 6140 tasklist.exe 5904 tasklist.exe 2616 tasklist.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1500 cmd.exe 1052 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Delays execution with timeout.exe 3 IoCs
pid Process 2904 timeout.exe 5932 timeout.exe 3392 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 2852 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe 2900 rundll32.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 2852 taskkill.exe Token: SeDebugPrivilege 5904 tasklist.exe Token: SeDebugPrivilege 2900 rundll32.exe Token: SeLoadDriverPrivilege 2900 rundll32.exe Token: SeTakeOwnershipPrivilege 2900 rundll32.exe Token: SeIncBasePriorityPrivilege 2900 rundll32.exe Token: SeTcbPrivilege 2900 rundll32.exe Token: SeDebugPrivilege 2900 rundll32.exe Token: SeCreateTokenPrivilege 2900 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2900 rundll32.exe Token: SeLockMemoryPrivilege 2900 rundll32.exe Token: SeIncreaseQuotaPrivilege 2900 rundll32.exe Token: SeMachineAccountPrivilege 2900 rundll32.exe Token: SeTcbPrivilege 2900 rundll32.exe Token: SeSecurityPrivilege 2900 rundll32.exe Token: SeTakeOwnershipPrivilege 2900 rundll32.exe Token: SeLoadDriverPrivilege 2900 rundll32.exe Token: SeSystemProfilePrivilege 2900 rundll32.exe Token: SeSystemtimePrivilege 2900 rundll32.exe Token: SeProfSingleProcessPrivilege 2900 rundll32.exe Token: SeIncBasePriorityPrivilege 2900 rundll32.exe Token: SeCreatePagefilePrivilege 2900 rundll32.exe Token: SeCreatePermanentPrivilege 2900 rundll32.exe Token: SeBackupPrivilege 2900 rundll32.exe Token: SeRestorePrivilege 2900 rundll32.exe Token: SeShutdownPrivilege 2900 rundll32.exe Token: SeDebugPrivilege 2900 rundll32.exe Token: SeAuditPrivilege 2900 rundll32.exe Token: SeSystemEnvironmentPrivilege 2900 rundll32.exe Token: SeChangeNotifyPrivilege 2900 rundll32.exe Token: SeRemoteShutdownPrivilege 2900 rundll32.exe Token: SeUndockPrivilege 2900 rundll32.exe Token: SeSyncAgentPrivilege 2900 rundll32.exe Token: SeEnableDelegationPrivilege 2900 rundll32.exe Token: SeManageVolumePrivilege 2900 rundll32.exe Token: SeImpersonatePrivilege 2900 rundll32.exe Token: SeCreateGlobalPrivilege 2900 rundll32.exe Token: 31 2900 rundll32.exe Token: 32 2900 rundll32.exe Token: 33 2900 rundll32.exe Token: 34 2900 rundll32.exe Token: 35 2900 rundll32.exe Token: SeDebugPrivilege 2616 tasklist.exe Token: SeDebugPrivilege 6140 tasklist.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2900 rundll32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3436 wrote to memory of 2900 3436 rundll32.exe 88 PID 2900 wrote to memory of 2852 2900 rundll32.exe 90 PID 2900 wrote to memory of 1500 2900 rundll32.exe 93 PID 1500 wrote to memory of 1052 1500 cmd.exe 95 PID 1052 wrote to memory of 5904 1052 cmd.exe 96 PID 1052 wrote to memory of 4440 1052 cmd.exe 97 PID 1052 wrote to memory of 2904 1052 cmd.exe 98 PID 1052 wrote to memory of 2616 1052 cmd.exe 102 PID 1052 wrote to memory of 2764 1052 cmd.exe 103 PID 1052 wrote to memory of 5932 1052 cmd.exe 104 PID 1052 wrote to memory of 6140 1052 cmd.exe 105 PID 1052 wrote to memory of 2356 1052 cmd.exe 106 PID 1052 wrote to memory of 3392 1052 cmd.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DB79946F96CBBD47E4782DCDD737A66E.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DB79946F96CBBD47E4782DCDD737A66E.dll,#12⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5904
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4440
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2904
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5932
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6140
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2356
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3392
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 220c113aa0f53f64941dc7efcf293c9b3ab8a60b88663c4613cb31b2020fe900
- MD5 bfca080c02bc611199f975693c3aca02
- SHA1 382dfcefb6769fe0434305aeaad1f7183db5e03f
- SHA512 5e5b031cf2c3403c2d6f4787358957da6a8cea76172d55a8a746a149d01228c6389773f46d271392e769bcfe47a1ecae0b426662cdd1f56a095738b8af3f1ff0
- TLSH T139311B8EC4174E1C431402EF139ACC5FC640E047EE9171D0B9E89B8023C5A8E09AABAD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\rundll32.exe
- Size 51KB
- SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
- MD5 2e068ce2770fde8d1af4cb114b98df1f
- SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
- SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
- SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
- TLSH T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
- MD5 SHA1 SHA512 SSDEEP TLSH