Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
DB.06846708.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
DB.06846708.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
LUA51.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
LUA51.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target LUA51.dll
- Size 5.3MB
- Sample260910-pvd7ascm2w
- SHA256 1334dd91cbe667bc7b8a4aac085bd0c0e1e6b606ca117ca80819cf6e1d4fc958
- MD5 27979de6993e6a1b990057d08cad4eb2
- SHA1 a98e7d3d38051ba6649a302eb849ae98aa018dc7
- SHA512 a0df96a2f40baa18ff1548ca10ae90c06cebcb6800bc020c3b8b8bf32c3460f344d02a174286fc377db4d1c588af8e774a7fdbff38831ebfcf9ab660f7d5a1c0
- SSDEEP 98304:CJPwTsC14klK0g04bzucg2znygnFmHpeZnC8zEN4OiZrq1DfPHNADtV6v+M:CRRIXKD04U2ygnFmHpMnhEN4O7NADtVb
- TLSH T1CE46C0313DDC3176D00E8130CE7DA2F9FAAE7D642B65009B1580BA1BFD317A25A1B95B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 9 4100 rundll32.exe 10 4100 rundll32.exe 11 4100 rundll32.exe 12 4100 rundll32.exe 13 4100 rundll32.exe 14 4100 rundll32.exe 16 4100 rundll32.exe - Executes dropped EXE 3 IoCs
pid Process 6020 NVIDIAWVenvHLGkjTl.pol 5440 NVIDIAvAvOuceGsebOfXVk.pol 1668 rundll32.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\N: rundll32.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 icanhazip.com - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3108 tasklist.exe 4804 tasklist.exe 3036 tasklist.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.exe rundll32.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3288 cmd.exe 4256 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Delays execution with timeout.exe 3 IoCs
pid Process 1816 timeout.exe 2720 timeout.exe 4876 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 2528 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe 4100 rundll32.exe - Suspicious behavior: LoadsDriver 57 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4100 rundll32.exe Token: SeLoadDriverPrivilege 4100 rundll32.exe Token: SeTakeOwnershipPrivilege 4100 rundll32.exe Token: SeIncBasePriorityPrivilege 4100 rundll32.exe Token: SeTcbPrivilege 4100 rundll32.exe Token: SeDebugPrivilege 2528 taskkill.exe Token: SeDebugPrivilege 3036 tasklist.exe Token: SeDebugPrivilege 4100 rundll32.exe Token: SeCreateTokenPrivilege 4100 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 4100 rundll32.exe Token: SeLockMemoryPrivilege 4100 rundll32.exe Token: SeIncreaseQuotaPrivilege 4100 rundll32.exe Token: SeMachineAccountPrivilege 4100 rundll32.exe Token: SeTcbPrivilege 4100 rundll32.exe Token: SeSecurityPrivilege 4100 rundll32.exe Token: SeTakeOwnershipPrivilege 4100 rundll32.exe Token: SeLoadDriverPrivilege 4100 rundll32.exe Token: SeSystemProfilePrivilege 4100 rundll32.exe Token: SeSystemtimePrivilege 4100 rundll32.exe Token: SeProfSingleProcessPrivilege 4100 rundll32.exe Token: SeIncBasePriorityPrivilege 4100 rundll32.exe Token: SeCreatePagefilePrivilege 4100 rundll32.exe Token: SeCreatePermanentPrivilege 4100 rundll32.exe Token: SeBackupPrivilege 4100 rundll32.exe Token: SeRestorePrivilege 4100 rundll32.exe Token: SeShutdownPrivilege 4100 rundll32.exe Token: SeDebugPrivilege 4100 rundll32.exe Token: SeAuditPrivilege 4100 rundll32.exe Token: SeSystemEnvironmentPrivilege 4100 rundll32.exe Token: SeChangeNotifyPrivilege 4100 rundll32.exe Token: SeRemoteShutdownPrivilege 4100 rundll32.exe Token: SeUndockPrivilege 4100 rundll32.exe Token: SeSyncAgentPrivilege 4100 rundll32.exe Token: SeEnableDelegationPrivilege 4100 rundll32.exe Token: SeManageVolumePrivilege 4100 rundll32.exe Token: SeImpersonatePrivilege 4100 rundll32.exe Token: SeCreateGlobalPrivilege 4100 rundll32.exe Token: 31 4100 rundll32.exe Token: 32 4100 rundll32.exe Token: 33 4100 rundll32.exe Token: 34 4100 rundll32.exe Token: 35 4100 rundll32.exe Token: SeDebugPrivilege 3108 tasklist.exe Token: SeDebugPrivilege 4804 tasklist.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4100 rundll32.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5280 wrote to memory of 4100 5280 rundll32.exe 89 PID 4100 wrote to memory of 2528 4100 rundll32.exe 94 PID 4100 wrote to memory of 4256 4100 rundll32.exe 97 PID 4256 wrote to memory of 3288 4256 cmd.exe 99 PID 3288 wrote to memory of 3036 3288 cmd.exe 100 PID 3288 wrote to memory of 1784 3288 cmd.exe 101 PID 3288 wrote to memory of 4876 3288 cmd.exe 102 PID 3288 wrote to memory of 3108 3288 cmd.exe 106 PID 3288 wrote to memory of 2344 3288 cmd.exe 107 PID 3288 wrote to memory of 1816 3288 cmd.exe 108 PID 3288 wrote to memory of 4804 3288 cmd.exe 109 PID 3288 wrote to memory of 584 3288 cmd.exe 110 PID 3288 wrote to memory of 2720 3288 cmd.exe 111
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LUA51.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\LUA51.dll,#12⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-3986082593-3624157295-3514260330\S-1-5-21-3986082593-3624157295-3514260330.bAt"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.execmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-3986082593-3624157295-3514260330\S-1-5-21-3986082593-3624157295-3514260330.bAt"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:1784
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4876
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2344
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1816
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV5⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\SysWOW64\find.exeFIND /I "rundll32.exe"5⤵
- System Location Discovery: System Language Discovery
PID:584
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak5⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2720
-
-
-
-
-
C:\Users\Public\NVIDIAWVenvHLGkjTl.polC:\Users\Public\NVIDIAWVenvHLGkjTl.pol1⤵
- Executes dropped EXE
PID:6020
-
C:\Users\Public\NVIDIAvAvOuceGsebOfXVk.polC:\Users\Public\NVIDIAvAvOuceGsebOfXVk.pol1⤵
- Executes dropped EXE
PID:5440
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\NVIDIA Corporation\S-1-5-21-3986082593-3624157295-3514260330\S-1-5-21-3986082593-3624157295-3514260330.bAt
- Size 1KB
- SHA256 1dc02478db5359f5d68925d9e5ccbf7d5bacdcd71e984b2419c0b39f6ff1d7fb
- MD5 9fa2f59564bbd56bf85da7726e2e4d9f
- SHA1 fdcbcf843163eb2a242b993a67701e84fd009744
- SHA512 2d925b766167bc7591c274d873f1a23ca226ea9315bf745bee556606e8cedf2d2e2d60d766ad25edccf81b60d54f42c1dcc1dabe0d20f655b041ebbff7d459ec
- TLSH T1E531FD8F84078D4D432642EF234A8C1FC640F407EE80708071D82B802346A9D0E9A6AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\NVIDIAWVenvHLGkjTl.pol
- Size 17KB
- SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
- MD5 a736339a04448a02b654b8dcf3f7a8de
- SHA1 45b324e0045ca76a70ebd3774b300c771b57025d
- SHA512 4fb474795237afc8c14c6cf9e90122efa497dcfe014eb689ed9ee1e0ede69001a1d83dc244dcbebaac567bbc3019f8476171f6edb80cc6bfca401fb610c6601f
- SSDEEP 192:JgvuYacCCpQIw9l0HKs0zTQxmaYe+PjP4wBjtlAv6YHmVm1OoG:JsuoCCpQIY0HKs0vkmaYPL4OUSYGVm1k
- TLSH T15B826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\NVIDIAWVenvHLGkjTl.pol.efi
- Size 17KB
- SHA256 df561907f273d59c2da31b4fdd7cebc31baadf8d0ef649883245dd40d956aad7
- MD5 8b14d54143fae7a47d55131574a7d2c5
- SHA1 ded9ae4d410029dc693c0aa5bafa2517a096db54
- SHA512 964471088eacf3f2c21cc424719b8343f86ee82517d6a1c3aca19d2cb670d397421ce01c2b4c0e249d02254b3038eeaad079cf7a80e8257882caebf79ac0c5e8
- SSDEEP 384:lphGCsqWVyzEwhr9y8Ysy/Ha48BRVX0EbIdc3BighNBD0HaMtQ+x8:DYiEwhgPsyPa4DEPHhNBD0HaMlK
- TLSH T19C82D04CE17DA9019F345320CFDA9DCC7C2693E258933CE409E89E2B9AADADC07594C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\NVIDIAvAvOuceGsebOfXVk.pol
- Size 32KB
- SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
- MD5 c260608456e573a9d4de3c935648086e
- SHA1 eabc6ee5869e011ae01014fdd8a89be3d237dd5b
- SHA512 24c5edcf96081705028704ab7529225dd911630be668ca7593cbc7cab107b72a62c000f7cf8adabeca04474e81c474446fe471a3ee9006b377dfcb3bb49f72a2
- SSDEEP 768:Nf+Wus4O4cTO2z2BuaVDNgijrrwn2899zud:1GF29aNgyw2szud
- TLSH T1B4E24BC966B804CAE6F782B4C2F9D6A6B970BA53172343EF0161C5740D63FD0DA35B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\NVIDIAvAvOuceGsebOfXVk.pol.efi
- Size 32KB
- SHA256 24da6fb34a3ae5bfc1ce8c8a856ce98a4689f29fb92acc30aece99dddbc3d11a
- MD5 fbc889365dd954ee13dff1aecc0cf7b8
- SHA1 dc133d1f13a0854d5900b484854086ae3d17a2ec
- SHA512 660d3f1a8ce9d83b144c0062ec9a4001acd3e94341dddd010ae6a82f55a47540effa266dee8493c38c3ea5fb2a3ff6fe1abbc87fcfb9c924856dac738ce968a3
- SSDEEP 768:A/9KUeWlpjed1SpWwvwRmIPw+j3uWSUUHsPBH94qs:SwUTp6dIpWwYRmYdX1UMJH96
- TLSH T10CE2F14DBB42DD9D7F8706239137F1E7F9C9722118683B60A885A165EF36C8F478209A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\rundll32.exe
- Size 51KB
- SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
- MD5 2e068ce2770fde8d1af4cb114b98df1f
- SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
- SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
- SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
- TLSH T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
- MD5 SHA1 SHA512 SSDEEP TLSH