Analysis
- max time kernel
35s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 18:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f42c77fc05af60b8e702ab357714890d2ce17419d63bcc108f00be7733e8c7c5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
f42c77fc05af60b8e702ab357714890d2ce17419d63bcc108f00be7733e8c7c5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target f42c77fc05af60b8e702ab357714890d2ce17419d63bcc108f00be7733e8c7c5.dll
- Size 5.8MB
- Sample260819-xkrnmsgk8y
- SHA256 f42c77fc05af60b8e702ab357714890d2ce17419d63bcc108f00be7733e8c7c5
- MD5 480f7e5181f67f318948ae9d304bc06f
- SHA1 8b0f970d3a3b51fa167d99d4fe0d4472187fdad3
- SHA512 2aebf19a713541b9195cc57feeff08d5270724791da7e9f69a95d4c866ad9b34e150e08e10e4659a419009b8fc07e5e87dae5ab08c740eaee13122a41988af64
- SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmVnrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkmxi1RZ4O7NADtV6v+zZT
- TLSH T18A56D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 3904 rundll32.exe 8 3904 rundll32.exe 9 3904 rundll32.exe 11 3904 rundll32.exe 12 3904 rundll32.exe 13 3904 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 2196 rundll32.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\T: rundll32.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 icanhazip.com - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2364 tasklist.exe 1776 tasklist.exe 3412 tasklist.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4604 cmd.exe 4932 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Delays execution with timeout.exe 3 IoCs
pid Process 576 timeout.exe 428 timeout.exe 1428 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 708 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe 3904 rundll32.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 3904 rundll32.exe Token: SeLoadDriverPrivilege 3904 rundll32.exe Token: SeTakeOwnershipPrivilege 3904 rundll32.exe Token: SeIncBasePriorityPrivilege 3904 rundll32.exe Token: SeTcbPrivilege 3904 rundll32.exe Token: SeDebugPrivilege 708 taskkill.exe Token: SeDebugPrivilege 2364 tasklist.exe Token: SeDebugPrivilege 3904 rundll32.exe Token: SeCreateTokenPrivilege 3904 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 3904 rundll32.exe Token: SeLockMemoryPrivilege 3904 rundll32.exe Token: SeIncreaseQuotaPrivilege 3904 rundll32.exe Token: SeMachineAccountPrivilege 3904 rundll32.exe Token: SeTcbPrivilege 3904 rundll32.exe Token: SeSecurityPrivilege 3904 rundll32.exe Token: SeTakeOwnershipPrivilege 3904 rundll32.exe Token: SeLoadDriverPrivilege 3904 rundll32.exe Token: SeSystemProfilePrivilege 3904 rundll32.exe Token: SeSystemtimePrivilege 3904 rundll32.exe Token: SeProfSingleProcessPrivilege 3904 rundll32.exe Token: SeIncBasePriorityPrivilege 3904 rundll32.exe Token: SeCreatePagefilePrivilege 3904 rundll32.exe Token: SeCreatePermanentPrivilege 3904 rundll32.exe Token: SeBackupPrivilege 3904 rundll32.exe Token: SeRestorePrivilege 3904 rundll32.exe Token: SeShutdownPrivilege 3904 rundll32.exe Token: SeDebugPrivilege 3904 rundll32.exe Token: SeAuditPrivilege 3904 rundll32.exe Token: SeSystemEnvironmentPrivilege 3904 rundll32.exe Token: SeChangeNotifyPrivilege 3904 rundll32.exe Token: SeRemoteShutdownPrivilege 3904 rundll32.exe Token: SeUndockPrivilege 3904 rundll32.exe Token: SeSyncAgentPrivilege 3904 rundll32.exe Token: SeEnableDelegationPrivilege 3904 rundll32.exe Token: SeManageVolumePrivilege 3904 rundll32.exe Token: SeImpersonatePrivilege 3904 rundll32.exe Token: SeCreateGlobalPrivilege 3904 rundll32.exe Token: 31 3904 rundll32.exe Token: 32 3904 rundll32.exe Token: 33 3904 rundll32.exe Token: 34 3904 rundll32.exe Token: 35 3904 rundll32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3904 rundll32.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5536 wrote to memory of 3904 5536 rundll32.exe 89 PID 3904 wrote to memory of 708 3904 rundll32.exe 90 PID 3904 wrote to memory of 4604 3904 rundll32.exe 93 PID 4604 wrote to memory of 4932 4604 cmd.exe 95 PID 4932 wrote to memory of 2364 4932 cmd.exe 96 PID 4932 wrote to memory of 3672 4932 cmd.exe 97 PID 4932 wrote to memory of 428 4932 cmd.exe 98
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f42c77fc05af60b8e702ab357714890d2ce17419d63bcc108f00be7733e8c7c5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f42c77fc05af60b8e702ab357714890d2ce17419d63bcc108f00be7733e8c7c5.dll,#12⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:708
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\ProgramData\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.execmd /C C:\ProgramData\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.CMD4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:428
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
PID:1776
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵PID:2988
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- Delays execution with timeout.exe
PID:1428
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
PID:3412
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵PID:5948
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- Delays execution with timeout.exe
PID:576
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.CMD
- Size 1KB
- SHA256 82370f345d189d8f9dab1ac115f5e00d04a08f11392bcb1197d9a2dcba2e154b
- MD5 5cd5cf94a17f8f7e4612b0f06985dddb
- SHA1 9047411cabb4b9c126ecb02e63037de75ea260f7
- SHA512 05cb34544e77fd37ecd8581dec480ce034bde61e92e01fe5243fde7582b68128fb5e0d5fe0f78b455887802a3bee9e6d0523e1e72bce379820693c16043d796d
- TLSH T12531C08EC8174E1C435507DF234ACC6AC650E057EEC571A0B0E86B952755F990866AED
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\rundll32.exe
- Size 51KB
- SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
- MD5 2e068ce2770fde8d1af4cb114b98df1f
- SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
- SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
- SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
- TLSH T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
- MD5 SHA1 SHA512 SSDEEP TLSH