Analysis
- user interaction
yes - max time kernel
147s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
20/08/2026, 23:35
General
- Target IttihadKit.exe
- Size 414KB
- Sample260820-3lc5jaxeja
- SHA256 8aed288328eabd5c211f04aac89cd96861030e97c2cf4da095898b5ce9a6afe4
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- NTFS ADS 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IttihadKit.exe"C:\Users\Admin\AppData\Local\Temp\IttihadKit.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\RenameDismount.bat" "1⤵
- Executes a command shell one-liner
- NTFS ADS
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F01⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\RenameDismount.bat" "1⤵
- Executes a command shell one-liner
- NTFS ADS
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\RenameDismount.bat" "1⤵
- Executes a command shell one-liner
- NTFS ADS
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\InstallResume.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\InstallResume.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ctyoR.dll
memory/2708-0-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/2708-1-0x0000000002110000-0x000000000217A000-memory.dmp
memory/2708-2-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/2708-3-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/2708-4-0x0000000004C90000-0x0000000005236000-memory.dmp
memory/2708-5-0x00000000023B0000-0x0000000002442000-memory.dmp
memory/2708-10-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/2708-11-0x0000000005260000-0x000000000526A000-memory.dmp
memory/2708-13-0x0000000000400000-0x0000000000406000-memory.dmp