Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BFC5C2051F563B2B0199CBD8A6237CAF.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
BFC5C2051F563B2B0199CBD8A6237CAF.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target BFC5C2051F563B2B0199CBD8A6237CAF.dll
- Size 5.7MB
- Sample260820-devnka1xas
- SHA256 51307cb85f159a0ccd4cd31efb33bf3aca0c56f612b667d801698fdd6656e775
- MD5 bfc5c2051f563b2b0199cbd8a6237caf
- SHA1 7f4b8d6456a185bd919cb908b886f2704ea5ea07
- SHA512 53dcb0617054a7f21e41c15ade449899e0c36707a3cced328b24d93dd4ab6f5a4cf1edc8f190bd1b0fbdfca2a7d7a6eb8f23a1ece328d7a550fa4ce6b37cfabb
- SSDEEP 98304:Jjv0DwP38wtCkCUyFJeT5ihmAcmI5J2ROVYoZ4OiZrq1DfPHNADtV6v+zM+rwroX:Jjb38w9bkmAcmI+MV9Z4O7NADtV6v+zn
- TLSH T1DD56D0117DEC0467E0AB03318EAAF2BC35BEBDA43F2561672784F61EF9313515A1522B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 4116 rundll32.exe 9 4116 rundll32.exe 14 4116 rundll32.exe 18 4116 rundll32.exe 20 4116 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 3860 rundll32.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\R: rundll32.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 api.ipify.org 17 icanhazip.com 18 icanhazip.com - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 640 tasklist.exe 644 tasklist.exe 3228 tasklist.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2180 cmd.exe 1672 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe - Delays execution with timeout.exe 3 IoCs
pid Process 2172 timeout.exe 1280 timeout.exe 3632 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 460 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4116 rundll32.exe Token: SeLoadDriverPrivilege 4116 rundll32.exe Token: SeTakeOwnershipPrivilege 4116 rundll32.exe Token: SeIncBasePriorityPrivilege 4116 rundll32.exe Token: SeTcbPrivilege 4116 rundll32.exe Token: SeDebugPrivilege 460 taskkill.exe Token: SeDebugPrivilege 640 tasklist.exe Token: SeDebugPrivilege 4116 rundll32.exe Token: SeCreateTokenPrivilege 4116 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 4116 rundll32.exe Token: SeLockMemoryPrivilege 4116 rundll32.exe Token: SeIncreaseQuotaPrivilege 4116 rundll32.exe Token: SeMachineAccountPrivilege 4116 rundll32.exe Token: SeTcbPrivilege 4116 rundll32.exe Token: SeSecurityPrivilege 4116 rundll32.exe Token: SeTakeOwnershipPrivilege 4116 rundll32.exe Token: SeLoadDriverPrivilege 4116 rundll32.exe Token: SeSystemProfilePrivilege 4116 rundll32.exe Token: SeSystemtimePrivilege 4116 rundll32.exe Token: SeProfSingleProcessPrivilege 4116 rundll32.exe Token: SeIncBasePriorityPrivilege 4116 rundll32.exe Token: SeCreatePagefilePrivilege 4116 rundll32.exe Token: SeCreatePermanentPrivilege 4116 rundll32.exe Token: SeBackupPrivilege 4116 rundll32.exe Token: SeRestorePrivilege 4116 rundll32.exe Token: SeShutdownPrivilege 4116 rundll32.exe Token: SeDebugPrivilege 4116 rundll32.exe Token: SeAuditPrivilege 4116 rundll32.exe Token: SeSystemEnvironmentPrivilege 4116 rundll32.exe Token: SeChangeNotifyPrivilege 4116 rundll32.exe Token: SeRemoteShutdownPrivilege 4116 rundll32.exe Token: SeUndockPrivilege 4116 rundll32.exe Token: SeSyncAgentPrivilege 4116 rundll32.exe Token: SeEnableDelegationPrivilege 4116 rundll32.exe Token: SeManageVolumePrivilege 4116 rundll32.exe Token: SeImpersonatePrivilege 4116 rundll32.exe Token: SeCreateGlobalPrivilege 4116 rundll32.exe Token: 31 4116 rundll32.exe Token: 32 4116 rundll32.exe Token: 33 4116 rundll32.exe Token: 34 4116 rundll32.exe Token: 35 4116 rundll32.exe Token: SeDebugPrivilege 644 tasklist.exe Token: SeDebugPrivilege 3228 tasklist.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4116 rundll32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2188 wrote to memory of 4116 2188 rundll32.exe 85 PID 4116 wrote to memory of 460 4116 rundll32.exe 86 PID 4116 wrote to memory of 2180 4116 rundll32.exe 89 PID 2180 wrote to memory of 1672 2180 cmd.exe 91 PID 1672 wrote to memory of 640 1672 cmd.exe 92 PID 1672 wrote to memory of 4828 1672 cmd.exe 93 PID 1672 wrote to memory of 2172 1672 cmd.exe 94 PID 1672 wrote to memory of 644 1672 cmd.exe 109 PID 1672 wrote to memory of 5044 1672 cmd.exe 110 PID 1672 wrote to memory of 1280 1672 cmd.exe 111 PID 1672 wrote to memory of 3228 1672 cmd.exe 114 PID 1672 wrote to memory of 2688 1672 cmd.exe 115 PID 1672 wrote to memory of 3632 1672 cmd.exe 116
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BFC5C2051F563B2B0199CBD8A6237CAF.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BFC5C2051F563B2B0199CBD8A6237CAF.dll,#12⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:460
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\S-1-5-21-889581200-2041691093-2048517887\S-1-5-21-889581200-2041691093-2048517887.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\S-1-5-21-889581200-2041691093-2048517887\S-1-5-21-889581200-2041691093-2048517887.CMD4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:4828
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2172
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:644
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:5044
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1280
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2688
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3632
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\S-1-5-21-889581200-2041691093-2048517887\S-1-5-21-889581200-2041691093-2048517887.CMD
- Size 1KB
- SHA256 e3540f96ae35f6648870ce42a4e66a1ddbef9a26a1f19d1cd731b7545ace5bee
- MD5 56f18371e34377a095683b1a8c930245
- SHA1 bbc2df5f91b5bb542dd86a06757907d32b2cbe61
- SHA512 3d8bb365a5948341feebd323f2c3d0931be04c548cb9e18f8deb3e2fa78e457582dd9cb1854055bb962dbfea98eb1ceaa8d0bd446ac2c9e3e04bbbfdff3f6d0e
- TLSH T1B731108EC4034D1D032001EF1B5ADC6EC650D087FED132D0719C6B94234AA5D1DA9FED
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\rundll32.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH