Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db4ae88eec1f5daa63a7e8aea2cf95018427c51149f726dcca418432bddc1e76.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
db4ae88eec1f5daa63a7e8aea2cf95018427c51149f726dcca418432bddc1e76.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target db4ae88eec1f5daa63a7e8aea2cf95018427c51149f726dcca418432bddc1e76.dll
- Size 8.1MB
- Sample260916-rxgrba1grh
- SHA256 db4ae88eec1f5daa63a7e8aea2cf95018427c51149f726dcca418432bddc1e76
- MD5 e5ca8d6e2f9625cf728d215497357a95
- SHA1 1b1d3f38957b301fe17888c286cb6662bb27ca28
- SHA512 f03e54b98203fb811b99afaa5fb6a99efe962307af2907dc0940efb56e4eac11915720a03df9937155b683902373674f4b0913a367d1f847d17b6698e93ccc6a
- SSDEEP 98304:to36O5kTiwZ0NhKrpuIt8n4+yiYAS3Q0i/V0Fn5AO31GfsnhOhr:tgmmNQM4XiY7i/V6bhOhr
- TLSH T1D086DF067EE980B9C4FAE13EC667896BD3F238010535DACF56A1CB452F33742992B365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4444 rundll32.exe 3 4444 rundll32.exe 4 4444 rundll32.exe 5 4444 rundll32.exe 6 4444 rundll32.exe 9 4444 rundll32.exe 13 4444 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe 4444 rundll32.exe - Suspicious behavior: LoadsDriver 29 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4444 rundll32.exe Token: SeIncBasePriorityPrivilege 4444 rundll32.exe Token: SeLoadDriverPrivilege 4444 rundll32.exe Token: SeTakeOwnershipPrivilege 4444 rundll32.exe Token: SeTcbPrivilege 4444 rundll32.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db4ae88eec1f5daa63a7e8aea2cf95018427c51149f726dcca418432bddc1e76.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵PID:3320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\NVLOCALIZEDCONFIG.SYS16-15-34
- Size 17KB
- SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
- MD5 a736339a04448a02b654b8dcf3f7a8de
- SHA1 45b324e0045ca76a70ebd3774b300c771b57025d
- SHA512 4fb474795237afc8c14c6cf9e90122efa497dcfe014eb689ed9ee1e0ede69001a1d83dc244dcbebaac567bbc3019f8476171f6edb80cc6bfca401fb610c6601f
- SSDEEP 192:JgvuYacCCpQIw9l0HKs0zTQxmaYe+PjP4wBjtlAv6YHmVm1OoG:JsuoCCpQIY0HKs0vkmaYPL4OUSYGVm1k
- TLSH T15B826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\NVLOCALIZEDCONFIG.SYS16-15-34.tmp
- Size 17KB
- SHA256 e6193eb204fe085e7a982aeb99ca8409c44ab4e675f9149d47ee8dd5a1dd3155
- MD5 8b7bd574f4b632516065df24309962c4
- SHA1 98b9a5f2b4ad27e61686b6c2ec0ec4200628112f
- SHA512 ea99696a55a4326987c7a5e51ca8c077c2ea8a286c6ba234fd4284f83f2fbb06d5d7f15455e1c09b20208c6f07f7849b625ea377c1743cf29248b2d1eea2f2f5
- SSDEEP 384:hJMrbrFGnAedVJ2MIEOYxUPbFPHil02qx6yB/T1fqNMd32py:hSxMLoMH+vil0Pxjb1fFd32M
- TLSH T17382E11AD8DDEDF0EA6526054A73A1E2F54E5EDC24AC1E3A0831C7190F059C7DCA3338
- MD5 SHA1 SHA512 SSDEEP TLSH