Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
server.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
server.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target server.dll
- Size 1.4MB
- Sample260817-pepm4azzf1
- SHA256 8ae68cc5c858a8a0645bc0a8874f86c422287a4cab9f9aa0e3a38b5cbc414dd9
- MD5 1289d1fe6c3a6948f42cd1f50f1d88f9
- SHA1 ce2a3e27534fa3441def3d12e1e80a71f4cdf0c2
- SHA512 6ee3855f54baefd3de682562b7be9be5d093ebc4d06501fa92f9bc14ab4082507e7e5c630d7d93e031b7c946373d3a5425f3b0dd614e88f0b3ee6c76f14ae515
- SSDEEP 24576:aGuDman1gRHVmq8/2RVQUBfRh2/8WXioFpc4B8AU7f/2yzCncZZD15U:DuDVn1KV0/2LQ8W/89oF5fi/2yen
- TLSH T199659E46A3F401A8D1B7C278C6579A1FD772780503609BDF2BE44B6A6F23BE05B3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3012 regsvr32.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2720 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2148 WMIC.exe 2148 WMIC.exe 2148 WMIC.exe 2148 WMIC.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe 3012 regsvr32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3012 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2148 WMIC.exe Token: SeSecurityPrivilege 2148 WMIC.exe Token: SeTakeOwnershipPrivilege 2148 WMIC.exe Token: SeLoadDriverPrivilege 2148 WMIC.exe Token: SeSystemProfilePrivilege 2148 WMIC.exe Token: SeSystemtimePrivilege 2148 WMIC.exe Token: SeProfSingleProcessPrivilege 2148 WMIC.exe Token: SeIncBasePriorityPrivilege 2148 WMIC.exe Token: SeCreatePagefilePrivilege 2148 WMIC.exe Token: SeBackupPrivilege 2148 WMIC.exe Token: SeRestorePrivilege 2148 WMIC.exe Token: SeShutdownPrivilege 2148 WMIC.exe Token: SeDebugPrivilege 2148 WMIC.exe Token: SeSystemEnvironmentPrivilege 2148 WMIC.exe Token: SeRemoteShutdownPrivilege 2148 WMIC.exe Token: SeUndockPrivilege 2148 WMIC.exe Token: SeManageVolumePrivilege 2148 WMIC.exe Token: 33 2148 WMIC.exe Token: 34 2148 WMIC.exe Token: 35 2148 WMIC.exe Token: 36 2148 WMIC.exe Token: SeIncreaseQuotaPrivilege 2148 WMIC.exe Token: SeSecurityPrivilege 2148 WMIC.exe Token: SeTakeOwnershipPrivilege 2148 WMIC.exe Token: SeLoadDriverPrivilege 2148 WMIC.exe Token: SeSystemProfilePrivilege 2148 WMIC.exe Token: SeSystemtimePrivilege 2148 WMIC.exe Token: SeProfSingleProcessPrivilege 2148 WMIC.exe Token: SeIncBasePriorityPrivilege 2148 WMIC.exe Token: SeCreatePagefilePrivilege 2148 WMIC.exe Token: SeBackupPrivilege 2148 WMIC.exe Token: SeRestorePrivilege 2148 WMIC.exe Token: SeShutdownPrivilege 2148 WMIC.exe Token: SeDebugPrivilege 2148 WMIC.exe Token: SeSystemEnvironmentPrivilege 2148 WMIC.exe Token: SeRemoteShutdownPrivilege 2148 WMIC.exe Token: SeUndockPrivilege 2148 WMIC.exe Token: SeManageVolumePrivilege 2148 WMIC.exe Token: 33 2148 WMIC.exe Token: 34 2148 WMIC.exe Token: 35 2148 WMIC.exe Token: 36 2148 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3012 regsvr32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2720 3012 regsvr32.exe 89 PID 2720 wrote to memory of 2148 2720 cmd.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\server.dll1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic csproduct get uuid2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-