Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 10:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll
- Size 9.1MB
- Sample260922-ml58batene
- SHA256 3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017
- MD5 9fc96d4a36e293fce9b211d5f6d1bb8d
- SHA1 0f92978b6a0ab2d6803a1d05b37df93a1e152e0d
- SHA512 889a775a9b524045b48b4879c5915afab34da1c67e9d3675210cdc95a08db0da9f59fe6bcb57a17f7560f8c321b58a6b4e12c7441c793f8eb29610d59ea1b3fd
- SSDEEP 196608:yG9i/FpYVCepi1N+k9rPhyh8ZAg1QqSpNowg4O7NADtV6v+u3q:r96P11pyh4HyKwu7T
- TLSH T1DEA6F1123D4D1066F45B0230DA59A2F8F5BE6C703A6124473DF8BA3ABFB1B42563917B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3364 uajTAMueUgbAZvArlIBFrlkQznduYoiJ.Njw.exe 3288 WfnyfASusxCqeLeYWDaUmSqVIAoHYfsJ.erR.exe 2092 pOhKkHlYgCZDoLtQQUAbhmfrPAjRrkmq.ciM.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\arPHaDUMP.Dll.ppt rundll32.exe File created C:\Windows\arPHaDUMP.Dll rundll32.exe File opened for modification C:\Windows\arPHaDUMP.Dll rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe - Modifies registry class 12 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/LVGhHEQkONGlHrYCJYPJTaIdePepotKX.UUx/pOhKkHlYgCZDoLtQQUAbhmfrPAjRrkmq.ciM.exe" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open\command\DelegateExecute rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/cjqkMdmqjGOUBRoZOXXBfgOyBEMomLoV.eNd/WfnyfASusxCqeLeYWDaUmSqVIAoHYfsJ.erR.exe" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/IQXYYXguNRvnIIViRcIkEESwGkzllvfz.hPC/uajTAMueUgbAZvArlIBFrlkQznduYoiJ.Njw.exe" rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 780 rundll32.exe Token: SeLoadDriverPrivilege 780 rundll32.exe Token: SeTakeOwnershipPrivilege 780 rundll32.exe Token: SeIncBasePriorityPrivilege 780 rundll32.exe Token: SeTcbPrivilege 780 rundll32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3692 wrote to memory of 780 3692 rundll32.exe 86 PID 780 wrote to memory of 2896 780 rundll32.exe 90 PID 2896 wrote to memory of 1120 2896 cmd.exe 92 PID 1120 wrote to memory of 3364 1120 ComputerDefaults.exe 93 PID 780 wrote to memory of 3776 780 rundll32.exe 96 PID 3776 wrote to memory of 3340 3776 cmd.exe 98 PID 3340 wrote to memory of 3288 3340 ComputerDefaults.exe 99 PID 780 wrote to memory of 432 780 rundll32.exe 107 PID 432 wrote to memory of 1660 432 cmd.exe 109 PID 1660 wrote to memory of 2092 1660 ComputerDefaults.exe 110
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f9dcc55e3daf7108dfdd161e799366d8ea95c8320fde89291c3160c30aef017.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\ProgramData\IQXYYXguNRvnIIViRcIkEESwGkzllvfz.hPC\uajTAMueUgbAZvArlIBFrlkQznduYoiJ.Njw.exe"uajTAMueUgbAZvArlIBFrlkQznduYoiJ.Njw.exe"5⤵
- Executes dropped EXE
PID:3364
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\ProgramData\cjqkMdmqjGOUBRoZOXXBfgOyBEMomLoV.eNd\WfnyfASusxCqeLeYWDaUmSqVIAoHYfsJ.erR.exe"WfnyfASusxCqeLeYWDaUmSqVIAoHYfsJ.erR.exe"5⤵
- Executes dropped EXE
PID:3288
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\ProgramData\LVGhHEQkONGlHrYCJYPJTaIdePepotKX.UUx\pOhKkHlYgCZDoLtQQUAbhmfrPAjRrkmq.ciM.exe"pOhKkHlYgCZDoLtQQUAbhmfrPAjRrkmq.ciM.exe"5⤵
- Executes dropped EXE
PID:2092
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\IQXYYXguNRvnIIViRcIkEESwGkzllvfz.hPC\uajTAMueUgbAZvArlIBFrlkQznduYoiJ.Njw.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH