0abbe08ec50615e8c1e87192d61b1419e7780251a035e72ffd92e0c6cde60ca2

Resubmissions

07/09/2026, 03:31

260907-d3anasbr5t10

07/09/2026, 03:26

260907-dzah5awtbs10

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80000.dll
Size 66KB
Sample260907-d3anasbr5t
SHA256 0abbe08ec50615e8c1e87192d61b1419e7780251a035e72ffd92e0c6cde60ca2
MD5 400439a05c61cfd61625749a7f1fd8f1
SHA1 8f5b0e02f9c6ff5547410e45554996fb64df7002
SHA512 2b05470280fde4fecda63035fa397798ae6b18f529a634040282ae9f8969ddaea488662e9f17848db0443b0ce99aa35bd43e01ddaa295c81629c95ac06514beb
SSDEEP 1536:i1CNFN96i6NI7q8U3gW6v/0DNHUYbLOyZeZjOdfJxFwKW01uGR/xOi7OCBKzR9dT:i1C3NSeW8UF+hT
TLSH
T1E3634B18D202832EE997107CE5F4D6B77C2A9E300785D4E367E2AE4545B5BE3EA71313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5252	rundll32.exe
8	5252	rundll32.exe
9	5252	rundll32.exe
10	5252	rundll32.exe
11	5252	rundll32.exe
12	5252	rundll32.exe
13	5252	rundll32.exe
14	5252	rundll32.exe
15	5252	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 5252	4856	rundll32.exe	89
PID 5252 wrote to memory of 3856	5252	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80000.dll,#1
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.txt

Path C:\Users\Admin\AppData\Local\Temp\.txt
Size 48B
SHA256 8d4dc3adb1c650cbcd8d6bca245083be6b4949dc74c19b5630391caf44bd0d5d
MD5 43382e1f053304855e9320c71ed3b6cd
SHA1 a7df410c7cd79bfe9a8fe980226f979d2330a5f9
SHA512 b1cc79429cdec123435de38cd5ebb4f106239167f1d2d490df555443f73351ccdc262e2c0618cd8b6fc430dd30b9f74c96590cb03c7ef72fb90eeef53532ad41
MD5 SHA1 SHA512

Submit Download