Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 14:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee.dll
- Size 8.9MB
- Sample260922-ry6f3age74
- SHA256 95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee
- MD5 28ec41d6b31566a5d31c9350257e104f
- SHA1 c233bf3ce8902821154ec56d4ebaf2d580ba1295
- SHA512 b75a4b8bbd0398b611d549dafcaa059e13880c428ad5979d6856c4150e95397899bd0065374584f5e8687ae8fb250b35540f6f49218482066d5b95aa11309157
- SSDEEP 196608:oqo0R5Sm4toXN7iFn6u9LrX8HvkdF3/nRg:oU7Sm1969LryvkD/nRg
- TLSH T1A196DF466EE8C0B9C5E6C03DC6678A9BD3F178410933C7DF56954A0A2F337528F2A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 1748 rundll32.exe 6 1748 rundll32.exe 7 1748 rundll32.exe 9 1748 rundll32.exe 10 1748 rundll32.exe 11 1748 rundll32.exe 12 1748 rundll32.exe 13 1748 rundll32.exe 14 1748 rundll32.exe 16 1748 rundll32.exe 17 1748 rundll32.exe 18 1748 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe - Suspicious behavior: LoadsDriver 38 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1748 rundll32.exe Token: SeIncBasePriorityPrivilege 1748 rundll32.exe Token: SeLoadDriverPrivilege 1748 rundll32.exe Token: SeTakeOwnershipPrivilege 1748 rundll32.exe Token: SeTcbPrivilege 1748 rundll32.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95f6b74b0de17740057fa80853ba26e5b7b2311654026f262075a10a92cd6bee.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵PID:960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\kMSYAjDlRIfSmgPi.EKw22-15-37
- Size 526KB
- SHA256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61
- MD5 10b3049f4a954665512eca5d24728c89
- SHA1 172c5ce3afab6d63fe12a7e036f20271b9d09c13
- SHA512 0e6e8a93bdc2f5523b05c77cfc110d91f3b0f7763500e4c9f60989aeb4d86805bc985e01779014df63a57e944e6d138a9fc3879bf26d853a1167c8c7193699d7
- SSDEEP 6144:mERwg6i21P20M6NqWhUOqLDtQrPxXfuEu1rHP3gk9fKgBb/PaeO:fwg6i21O0p49OwQr5mEu1N9ds
- TLSH T1C2B4B059D3A108A6F167D07FCAA7C55AEAB27888974086DF42B4CD855F27BF0F138342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kMSYAjDlRIfSmgPi.EKw22-15-37.pak
- Size 526KB
- SHA256 1149259132bfa53de9f728edcc8c8ac2906a459e2c52200ac0cbe7708bfbcdde
- MD5 4e5f2d6780402cf486bdcf1cd1f579d1
- SHA1 d44e896d1fb9214851c2bbf3c274f6aaa04cb8a6
- SHA512 1f2c55eb3ffb61ef678f21949aa8c4dda283a1d83a04f87c48eabff2e2636ca1132b0c67a8e9d46aa2572e98adef561b6caac7f60c0cbf9461add0e6b675175f
- SSDEEP 12288:M5/OUgMID2Q6vtHZKjbcV16htEahPPFeAGp44jzPlIiCuf:AOUcDwvt5qcaXE4PdAlfGibf
- TLSH T105B4239C4715E41B45D2FCAC76B6B4EEC8FAA03432A1A07A1D448F4C125EB7B9B1E6C4
- MD5 SHA1 SHA512 SSDEEP TLSH