Analysis
- max time kernel
148s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3adc0c9ca9dc1e75852fcb6d9c8831cc5ff98a2642fb27f3d6bc7abfd1eff864.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3adc0c9ca9dc1e75852fcb6d9c8831cc5ff98a2642fb27f3d6bc7abfd1eff864.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 3adc0c9ca9dc1e75852fcb6d9c8831cc5ff98a2642fb27f3d6bc7abfd1eff864.dll
- Size 9.2MB
- Sample260820-gh4mestscx
- SHA256 3adc0c9ca9dc1e75852fcb6d9c8831cc5ff98a2642fb27f3d6bc7abfd1eff864
- MD5 bdfdb20b0fc33edabfd4b0c09fb5cd49
- SHA1 28371493013d3c997ecba5d90b6fff88abb03051
- SHA512 d7ce9618ab82467f56a30cd1db476e348b93b930e78a99544143f145a76285c0c2a6ca73d60a45f02b8bd54d373af60938576d9e02ba6e3318904c11650de005
- SSDEEP 196608:1A5u0mOPU3m91LMEr8IO33jBg8/E8rG6spsifA0EH:147rsmscjq8UGlpLAT
- TLSH T186A6DF456EE9C0B5C5E6D03DC61B4B9BD3F278010A3287CF67554B0A6F73B628A2A335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 4920 rundll32.exe 6 4920 rundll32.exe 10 4920 rundll32.exe 12 4920 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe 4920 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4920 rundll32.exe Token: SeIncBasePriorityPrivilege 4920 rundll32.exe Token: SeLoadDriverPrivilege 4920 rundll32.exe Token: SeTakeOwnershipPrivilege 4920 rundll32.exe Token: SeTcbPrivilege 4920 rundll32.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3adc0c9ca9dc1e75852fcb6d9c8831cc5ff98a2642fb27f3d6bc7abfd1eff864.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵PID:6100