2c76ddda266dbada9597eec8d7559b0669c25f2037344c19b4807e4d61b6dcfe

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gobject-2.0.dll
Size 293KB
Sample260916-thf8casfmc
SHA256 2c76ddda266dbada9597eec8d7559b0669c25f2037344c19b4807e4d61b6dcfe
MD5 103bf98f16d5dda06336b3f0f10bb979
SHA1 693aea2e2e97ff1c029066aa2440d01b7792c68a
SHA512 949638780a315efb8229f01fd9fad365ec5fe393d3d66cd1fe4676224b18e38b6c02347827c9551e23b12e2a742f16aff1762fb942c27f07484d13bd90884695
SSDEEP 6144:KazHASmQbLH5T279peOal8JcrL+H+dCnI8XiuPqlcKHXQvUkC:pzHASjH5TG9peH8JcjqikKPF
TLSH
T1DB544A5D72986C69EE6BC038C652D507D2B274011362A7CF17B083AA1F37AE5F93E706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4772	powershell.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gobject-2.0.dll,#1
1⤵
PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\0b09b12c.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads