Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
DB.06846708.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
DB.06846708.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
LUA51.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
LUA51.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target LUA51.dll
- Size 5.3MB
- Sample260910-pth4vstcnh
- SHA256 1334dd91cbe667bc7b8a4aac085bd0c0e1e6b606ca117ca80819cf6e1d4fc958
- MD5 27979de6993e6a1b990057d08cad4eb2
- SHA1 a98e7d3d38051ba6649a302eb849ae98aa018dc7
- SHA512 a0df96a2f40baa18ff1548ca10ae90c06cebcb6800bc020c3b8b8bf32c3460f344d02a174286fc377db4d1c588af8e774a7fdbff38831ebfcf9ab660f7d5a1c0
- SSDEEP 98304:CJPwTsC14klK0g04bzucg2znygnFmHpeZnC8zEN4OiZrq1DfPHNADtV6v+M:CRRIXKD04U2ygnFmHpMnhEN4O7NADtVb
- TLSH T1CE46C0313DDC3176D00E8130CE7DA2F9FAAE7D642B65009B1580BA1BFD317A25A1B95B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 6300 rundll32.exe 11 6300 rundll32.exe 12 6300 rundll32.exe 13 6300 rundll32.exe 15 6300 rundll32.exe 16 6300 rundll32.exe 17 6300 rundll32.exe 18 6300 rundll32.exe 19 6300 rundll32.exe - Executes dropped EXE 3 IoCs
pid Process 1628 NVIDIAfULqnKivTFUw.pol 4396 NVIDIAUOIkARKMOzEixsHW.pol 1212 rundll32.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\R: rundll32.exe - Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 icanhazip.com 1 ip-api.com 12 api.ipify.org 17 icanhazip.com 1 api.ipify.org - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4052 tasklist.exe 3648 tasklist.exe 3904 tasklist.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 832 cmd.exe 4708 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Delays execution with timeout.exe 3 IoCs
pid Process 1940 timeout.exe 1268 timeout.exe 1572 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 6768 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe 6300 rundll32.exe - Suspicious behavior: LoadsDriver 57 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 6300 rundll32.exe Token: SeLoadDriverPrivilege 6300 rundll32.exe Token: SeTakeOwnershipPrivilege 6300 rundll32.exe Token: SeIncBasePriorityPrivilege 6300 rundll32.exe Token: SeTcbPrivilege 6300 rundll32.exe Token: SeDebugPrivilege 6768 taskkill.exe Token: SeDebugPrivilege 3904 tasklist.exe Token: SeDebugPrivilege 6300 rundll32.exe Token: SeCreateTokenPrivilege 6300 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 6300 rundll32.exe Token: SeLockMemoryPrivilege 6300 rundll32.exe Token: SeIncreaseQuotaPrivilege 6300 rundll32.exe Token: SeMachineAccountPrivilege 6300 rundll32.exe Token: SeTcbPrivilege 6300 rundll32.exe Token: SeSecurityPrivilege 6300 rundll32.exe Token: SeTakeOwnershipPrivilege 6300 rundll32.exe Token: SeLoadDriverPrivilege 6300 rundll32.exe Token: SeSystemProfilePrivilege 6300 rundll32.exe Token: SeSystemtimePrivilege 6300 rundll32.exe Token: SeProfSingleProcessPrivilege 6300 rundll32.exe Token: SeIncBasePriorityPrivilege 6300 rundll32.exe Token: SeCreatePagefilePrivilege 6300 rundll32.exe Token: SeCreatePermanentPrivilege 6300 rundll32.exe Token: SeBackupPrivilege 6300 rundll32.exe Token: SeRestorePrivilege 6300 rundll32.exe Token: SeShutdownPrivilege 6300 rundll32.exe Token: SeDebugPrivilege 6300 rundll32.exe Token: SeAuditPrivilege 6300 rundll32.exe Token: SeSystemEnvironmentPrivilege 6300 rundll32.exe Token: SeChangeNotifyPrivilege 6300 rundll32.exe Token: SeRemoteShutdownPrivilege 6300 rundll32.exe Token: SeUndockPrivilege 6300 rundll32.exe Token: SeSyncAgentPrivilege 6300 rundll32.exe Token: SeEnableDelegationPrivilege 6300 rundll32.exe Token: SeManageVolumePrivilege 6300 rundll32.exe Token: SeImpersonatePrivilege 6300 rundll32.exe Token: SeCreateGlobalPrivilege 6300 rundll32.exe Token: 31 6300 rundll32.exe Token: 32 6300 rundll32.exe Token: 33 6300 rundll32.exe Token: 34 6300 rundll32.exe Token: 35 6300 rundll32.exe Token: SeDebugPrivilege 4052 tasklist.exe Token: SeDebugPrivilege 3648 tasklist.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6300 rundll32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2804 wrote to memory of 6300 2804 rundll32.exe 90 PID 6300 wrote to memory of 6768 6300 rundll32.exe 95 PID 6300 wrote to memory of 832 6300 rundll32.exe 98 PID 832 wrote to memory of 4708 832 cmd.exe 100 PID 4708 wrote to memory of 3904 4708 cmd.exe 101 PID 4708 wrote to memory of 3508 4708 cmd.exe 102 PID 4708 wrote to memory of 1268 4708 cmd.exe 103 PID 4708 wrote to memory of 4052 4708 cmd.exe 107 PID 4708 wrote to memory of 6552 4708 cmd.exe 108 PID 4708 wrote to memory of 1572 4708 cmd.exe 109 PID 4708 wrote to memory of 3648 4708 cmd.exe 110 PID 4708 wrote to memory of 3100 4708 cmd.exe 111 PID 4708 wrote to memory of 1940 4708 cmd.exe 112
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LUA51.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LUA51.dll,#12⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6300 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6768
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-1014449518-1831897916-4205727055\S-1-5-21-1014449518-1831897916-4205727055.bAt"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.execmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-1014449518-1831897916-4205727055\S-1-5-21-1014449518-1831897916-4205727055.bAt"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3508
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1268
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4052
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:6552
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1572
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:3100
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1940
-
-
-
-
-
C:\Users\Public\NVIDIAfULqnKivTFUw.polC:\Users\Public\NVIDIAfULqnKivTFUw.pol1⤵
- Executes dropped EXE
PID:1628
-
C:\Users\Public\NVIDIAUOIkARKMOzEixsHW.polC:\Users\Public\NVIDIAUOIkARKMOzEixsHW.pol1⤵
- Executes dropped EXE
PID:4396
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\NVIDIA Corporation\S-1-5-21-1014449518-1831897916-4205727055\S-1-5-21-1014449518-1831897916-4205727055.bAt
- Size 1KB
- SHA256 0848680281f1e6de166860dba863f8a8b14ab2a982be51dae4e283b6f40617a1
- MD5 718ae82d5115d2bf485667e4f1843849
- SHA1 fe3e2f85c5f9dd455901a9e279d65d2fd813a95b
- SHA512 e88671776bfe8664ca11fc2c1717a6478a585cbd9b45dc7a6ee82d16f77f6e12769251ffdcd2affaa6fe9678c4c089f23d6a002b035ee230320bdc9ecf06b664
- TLSH T1D331154FC8134D0D036502EB130A8CABC658F047EE85B09071A85F85338AA9F0F96FAE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\NVIDIAUOIkARKMOzEixsHW.pol
- Size 32KB
- SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
- MD5 c260608456e573a9d4de3c935648086e
- SHA1 eabc6ee5869e011ae01014fdd8a89be3d237dd5b
- SHA512 24c5edcf96081705028704ab7529225dd911630be668ca7593cbc7cab107b72a62c000f7cf8adabeca04474e81c474446fe471a3ee9006b377dfcb3bb49f72a2
- SSDEEP 768:Nf+Wus4O4cTO2z2BuaVDNgijrrwn2899zud:1GF29aNgyw2szud
- TLSH T1B4E24BC966B804CAE6F782B4C2F9D6A6B970BA53172343EF0161C5740D63FD0DA35B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\NVIDIAUOIkARKMOzEixsHW.pol.efi
- Size 32KB
- SHA256 24da6fb34a3ae5bfc1ce8c8a856ce98a4689f29fb92acc30aece99dddbc3d11a
- MD5 fbc889365dd954ee13dff1aecc0cf7b8
- SHA1 dc133d1f13a0854d5900b484854086ae3d17a2ec
- SHA512 660d3f1a8ce9d83b144c0062ec9a4001acd3e94341dddd010ae6a82f55a47540effa266dee8493c38c3ea5fb2a3ff6fe1abbc87fcfb9c924856dac738ce968a3
- SSDEEP 768:A/9KUeWlpjed1SpWwvwRmIPw+j3uWSUUHsPBH94qs:SwUTp6dIpWwYRmYdX1UMJH96
- TLSH T10CE2F14DBB42DD9D7F8706239137F1E7F9C9722118683B60A885A165EF36C8F478209A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\NVIDIAfULqnKivTFUw.pol
- Size 17KB
- SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
- MD5 a736339a04448a02b654b8dcf3f7a8de
- SHA1 45b324e0045ca76a70ebd3774b300c771b57025d
- SHA512 4fb474795237afc8c14c6cf9e90122efa497dcfe014eb689ed9ee1e0ede69001a1d83dc244dcbebaac567bbc3019f8476171f6edb80cc6bfca401fb610c6601f
- SSDEEP 192:JgvuYacCCpQIw9l0HKs0zTQxmaYe+PjP4wBjtlAv6YHmVm1OoG:JsuoCCpQIY0HKs0vkmaYPL4OUSYGVm1k
- TLSH T15B826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\NVIDIAfULqnKivTFUw.pol.efi
- Size 17KB
- SHA256 df561907f273d59c2da31b4fdd7cebc31baadf8d0ef649883245dd40d956aad7
- MD5 8b14d54143fae7a47d55131574a7d2c5
- SHA1 ded9ae4d410029dc693c0aa5bafa2517a096db54
- SHA512 964471088eacf3f2c21cc424719b8343f86ee82517d6a1c3aca19d2cb670d397421ce01c2b4c0e249d02254b3038eeaad079cf7a80e8257882caebf79ac0c5e8
- SSDEEP 384:lphGCsqWVyzEwhr9y8Ysy/Ha48BRVX0EbIdc3BighNBD0HaMtQ+x8:DYiEwhgPsyPa4DEPHhNBD0HaMlK
- TLSH T19C82D04CE17DA9019F345320CFDA9DCC7C2693E258933CE409E89E2B9AADADC07594C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\rundll32.exe
- Size 51KB
- SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
- MD5 2e068ce2770fde8d1af4cb114b98df1f
- SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
- SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
- SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
- TLSH T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
- MD5 SHA1 SHA512 SSDEEP TLSH