1334dd91cbe667bc7b8a4aac085bd0c0e1e6b606ca117ca80819cf6e1d4fc958

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LUA51.dll
Size 5.3MB
Sample260910-pvd7ascm2w
SHA256 1334dd91cbe667bc7b8a4aac085bd0c0e1e6b606ca117ca80819cf6e1d4fc958
MD5 27979de6993e6a1b990057d08cad4eb2
SHA1 a98e7d3d38051ba6649a302eb849ae98aa018dc7
SHA512 a0df96a2f40baa18ff1548ca10ae90c06cebcb6800bc020c3b8b8bf32c3460f344d02a174286fc377db4d1c588af8e774a7fdbff38831ebfcf9ab660f7d5a1c0
SSDEEP 98304:CJPwTsC14klK0g04bzucg2znygnFmHpeZnC8zEN4OiZrq1DfPHNADtV6v+M:CRRIXKD04U2ygnFmHpMnhEN4O7NADtVb
TLSH
T1CE46C0313DDC3176D00E8130CE7DA2F9FAAE7D642B65009B1580BA1BFD317A25A1B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 14 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	1224	rundll32.exe
12	1224	rundll32.exe
14	1224	rundll32.exe
16	1224	rundll32.exe
23	1224	rundll32.exe
33	1224	rundll32.exe
34	1224	rundll32.exe
35	1224	rundll32.exe
37	1224	rundll32.exe
42	1224	rundll32.exe
44	1224	rundll32.exe
53	1224	rundll32.exe
55	1224	rundll32.exe
57	1224	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
3124	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	api.ipify.org
14	api.ipify.org
34	api.ipify.org
36	icanhazip.com
43	ip-api.com

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1952	tasklist.exe
2188	tasklist.exe
2500	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4712	cmd.exe
4268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
4760	timeout.exe
1528	timeout.exe
4192	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4504	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	rundll32.exe
Token: SeLoadDriverPrivilege	1224	rundll32.exe
Token: SeTakeOwnershipPrivilege	1224	rundll32.exe
Token: SeIncBasePriorityPrivilege	1224	rundll32.exe
Token: SeTcbPrivilege	1224	rundll32.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	1224	rundll32.exe
Token: SeCreateTokenPrivilege	1224	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	1224	rundll32.exe
Token: SeLockMemoryPrivilege	1224	rundll32.exe
Token: SeIncreaseQuotaPrivilege	1224	rundll32.exe
Token: SeMachineAccountPrivilege	1224	rundll32.exe
Token: SeTcbPrivilege	1224	rundll32.exe
Token: SeSecurityPrivilege	1224	rundll32.exe
Token: SeTakeOwnershipPrivilege	1224	rundll32.exe
Token: SeLoadDriverPrivilege	1224	rundll32.exe
Token: SeSystemProfilePrivilege	1224	rundll32.exe
Token: SeSystemtimePrivilege	1224	rundll32.exe
Token: SeProfSingleProcessPrivilege	1224	rundll32.exe
Token: SeIncBasePriorityPrivilege	1224	rundll32.exe
Token: SeCreatePagefilePrivilege	1224	rundll32.exe
Token: SeCreatePermanentPrivilege	1224	rundll32.exe
Token: SeBackupPrivilege	1224	rundll32.exe
Token: SeRestorePrivilege	1224	rundll32.exe
Token: SeShutdownPrivilege	1224	rundll32.exe
Token: SeDebugPrivilege	1224	rundll32.exe
Token: SeAuditPrivilege	1224	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1224	rundll32.exe
Token: SeChangeNotifyPrivilege	1224	rundll32.exe
Token: SeRemoteShutdownPrivilege	1224	rundll32.exe
Token: SeUndockPrivilege	1224	rundll32.exe
Token: SeSyncAgentPrivilege	1224	rundll32.exe
Token: SeEnableDelegationPrivilege	1224	rundll32.exe
Token: SeManageVolumePrivilege	1224	rundll32.exe
Token: SeImpersonatePrivilege	1224	rundll32.exe
Token: SeCreateGlobalPrivilege	1224	rundll32.exe
Token: 31	1224	rundll32.exe
Token: 32	1224	rundll32.exe
Token: 33	1224	rundll32.exe
Token: 34	1224	rundll32.exe
Token: 35	1224	rundll32.exe
Token: SeDebugPrivilege	1952	tasklist.exe
Token: SeDebugPrivilege	2188	tasklist.exe
Token: SeDebugPrivilege	2500	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1224	rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1224	4604	rundll32.exe	85
PID 1224 wrote to memory of 4504	1224	rundll32.exe	86
PID 1224 wrote to memory of 4268	1224	rundll32.exe	89
PID 4268 wrote to memory of 4712	4268	cmd.exe	91
PID 4712 wrote to memory of 1952	4712	cmd.exe	92
PID 4712 wrote to memory of 4564	4712	cmd.exe	93
PID 4712 wrote to memory of 4760	4712	cmd.exe	95
PID 4712 wrote to memory of 2188	4712	cmd.exe	104
PID 4712 wrote to memory of 884	4712	cmd.exe	105
PID 4712 wrote to memory of 1528	4712	cmd.exe	106
PID 4712 wrote to memory of 2500	4712	cmd.exe	108
PID 4712 wrote to memory of 1676	4712	cmd.exe	109
PID 4712 wrote to memory of 4192	4712	cmd.exe	110

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LUA51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LUA51.dll,#1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-540052884-2969440504-464782435\S-1-5-21-540052884-2969440504-464782435.bAt"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-540052884-2969440504-464782435\S-1-5-21-540052884-2969440504-464782435.bAt"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4760
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:884
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1528
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4192

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S-1-5-21-540052884-2969440504-464782435.bAt

Path C:\Users\Public\NVIDIA Corporation\S-1-5-21-540052884-2969440504-464782435\S-1-5-21-540052884-2969440504-464782435.bAt
Size 1KB
SHA256 a3c8fe8ce46e4f0a07150d20a760949477df63a6280f0deda1b164fe7d39058c
MD5 6e5835055bf8406868cd3f299a9849fd
SHA1 c1272d39fb990bea717133abd7e3741c63c8ae08
SHA512 3929413f9a0ccff619af15eb42ca508b2732b86b149ee3901ccc4da8ad6ec7359c4329095f30c53b8111839fa3713b3be77296bd2562507db8696be44d11732a
TLSH
T1333110AFC8135D1D431442DB230ADC6BCA58F05BEE5A30D071D8EB852389A9D0A65BFE
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
TLSH
T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-7-0x00000000038A0000-0x0000000003905000-memory.dmp

Download

memory/1224-9-0x0000000003A90000-0x0000000003AFC000-memory.dmp

Download

memory/1224-8-0x0000000003A90000-0x0000000003AFC000-memory.dmp

Download

memory/1224-12-0x0000000003A90000-0x0000000003AFC000-memory.dmp

Download

memory/1224-15-0x0000000003A90000-0x0000000003AFC000-memory.dmp

Download

memory/1224-14-0x0000000003A90000-0x0000000003AFC000-memory.dmp

Download

memory/1224-17-0x0000000003A90000-0x0000000003AFC000-memory.dmp

Download