Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33e2a5407e8e46d353aa1ea1970fa374dce41cd21b7840140a9eefcaa6ac48fb.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
33e2a5407e8e46d353aa1ea1970fa374dce41cd21b7840140a9eefcaa6ac48fb.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 33e2a5407e8e46d353aa1ea1970fa374dce41cd21b7840140a9eefcaa6ac48fb.dll
- Size 5.8MB
- Sample260820-thd3zstyfv
- SHA256 33e2a5407e8e46d353aa1ea1970fa374dce41cd21b7840140a9eefcaa6ac48fb
- MD5 cad64dd9d3b94f6078ba4fb30d16580b
- SHA1 1fa15ba43a6a108ac482bad1e6f60203eced142f
- SHA512 fdae50be005c67eecc388da0e1ee8043190acbeeffd5d2340823ef9904c769f743b905594aa9b83f4f8c071e483683957141b906ae10f6e42169a5236849db96
- SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmonrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkmii1RZ4O7NADtV6v+zZT
- TLSH T19056D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 40 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 4236 rundll32.exe 16 4236 rundll32.exe 18 4236 rundll32.exe 19 4236 rundll32.exe 20 4236 rundll32.exe 21 4236 rundll32.exe 24 4236 rundll32.exe 25 4236 rundll32.exe 29 4236 rundll32.exe 30 4236 rundll32.exe 31 4236 rundll32.exe 37 4236 rundll32.exe 38 4236 rundll32.exe 43 4236 rundll32.exe 44 4236 rundll32.exe 48 4236 rundll32.exe 49 4236 rundll32.exe 50 4236 rundll32.exe 51 4236 rundll32.exe 52 4236 rundll32.exe 53 4236 rundll32.exe 54 4236 rundll32.exe 55 4236 rundll32.exe 58 4236 rundll32.exe 59 4236 rundll32.exe 60 4236 rundll32.exe 61 4236 rundll32.exe 62 4236 rundll32.exe 69 4236 rundll32.exe 70 4236 rundll32.exe 71 4236 rundll32.exe 72 4236 rundll32.exe 73 4236 rundll32.exe 74 4236 rundll32.exe 76 4236 rundll32.exe 77 4236 rundll32.exe 78 4236 rundll32.exe 79 4236 rundll32.exe 80 4236 rundll32.exe 81 4236 rundll32.exe - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2152 tasklist.exe 3376 tasklist.exe 4848 tasklist.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4648 cmd.exe 2844 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Delays execution with timeout.exe 3 IoCs
pid Process 4264 timeout.exe 3060 timeout.exe 2112 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 3564 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe 4236 rundll32.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4236 rundll32.exe Token: SeLoadDriverPrivilege 4236 rundll32.exe Token: SeTakeOwnershipPrivilege 4236 rundll32.exe Token: SeIncBasePriorityPrivilege 4236 rundll32.exe Token: SeTcbPrivilege 4236 rundll32.exe Token: SeDebugPrivilege 3564 taskkill.exe Token: SeDebugPrivilege 2152 tasklist.exe Token: SeDebugPrivilege 3376 tasklist.exe Token: SeDebugPrivilege 4848 tasklist.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1500 wrote to memory of 4236 1500 rundll32.exe 86 PID 4236 wrote to memory of 3564 4236 rundll32.exe 92 PID 4236 wrote to memory of 4648 4236 rundll32.exe 96 PID 4648 wrote to memory of 2844 4648 cmd.exe 98 PID 2844 wrote to memory of 2152 2844 cmd.exe 99 PID 2844 wrote to memory of 3700 2844 cmd.exe 100 PID 2844 wrote to memory of 4264 2844 cmd.exe 101 PID 2844 wrote to memory of 3376 2844 cmd.exe 104 PID 2844 wrote to memory of 3364 2844 cmd.exe 105 PID 2844 wrote to memory of 3060 2844 cmd.exe 106 PID 2844 wrote to memory of 4848 2844 cmd.exe 107 PID 2844 wrote to memory of 1016 2844 cmd.exe 108 PID 2844 wrote to memory of 2112 2844 cmd.exe 109
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33e2a5407e8e46d353aa1ea1970fa374dce41cd21b7840140a9eefcaa6ac48fb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33e2a5407e8e46d353aa1ea1970fa374dce41cd21b7840140a9eefcaa6ac48fb.dll,#12⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\ProgramData\S-1-5-21-1074038928-2032447174-945360078\S-1-5-21-1074038928-2032447174-945360078.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.execmd /C C:\ProgramData\S-1-5-21-1074038928-2032447174-945360078\S-1-5-21-1074038928-2032447174-945360078.CMD4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3700
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4264
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3364
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3060
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1016
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2112
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\S-1-5-21-1074038928-2032447174-945360078\S-1-5-21-1074038928-2032447174-945360078.CMD
- Size 1KB
- SHA256 3e87ae1e832c32c80ebde1faf43103bedb20c5f1e00a2b14e7660980a994ff45
- MD5 5905730f17ee756b659e59d4d01a5a98
- SHA1 969453e75dbab1ddbf4fd8b5efdba6d6b1c6c8b2
- SHA512 e373d4649f253615f9a0d66fb4b9fe5246bb80d8cec037b0c405230e7ec849b04cfd93a15cb62e3370abc947cca9a602b9fbbaa3ba4413d72fa142de5088e82d
- TLSH T160311B8EC8530E1C436603DB134ECCBAC640E047EE8560A0B1C82B812386B9909A9BED
- MD5 SHA1 SHA512 TLSH