Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15288ebc036f65393c416249c28742ff24691cf5537e853b7142cbcef9cb9002.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
15288ebc036f65393c416249c28742ff24691cf5537e853b7142cbcef9cb9002.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 15288ebc036f65393c416249c28742ff24691cf5537e853b7142cbcef9cb9002.dll
- Size 8.9MB
- Sample260924-c2gvjscc66
- SHA256 15288ebc036f65393c416249c28742ff24691cf5537e853b7142cbcef9cb9002
- MD5 e9b3e5367c007f4d776c33f5d43f3c5f
- SHA1 4c3888c87cfd57e0c8ea15af1b583725edf4b2be
- SHA512 a3049ac109d3500ba88e42ed8ab36208a4b2da920cde0fad70da1d070e88d90a6caa2d0f969a15d7638016b4042261b1fa20a0e9178943cb2f991338e09d99a3
- SSDEEP 196608:oqo0R5Sm4tIXN7iFn6u9LrX8HvkdF3/nR:oU7SmF969LryvkD/nR
- TLSH T16396DF466EE8C0B9C5E6C03DC6278A9BD3F178411933C7DF56954A0A2F337528F2A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 5240 rundll32.exe 8 5240 rundll32.exe 9 5240 rundll32.exe 10 5240 rundll32.exe 11 5240 rundll32.exe 12 5240 rundll32.exe 16 5240 rundll32.exe 19 5240 rundll32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe 5240 rundll32.exe - Suspicious behavior: LoadsDriver 48 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5240 rundll32.exe Token: SeIncBasePriorityPrivilege 5240 rundll32.exe Token: SeLoadDriverPrivilege 5240 rundll32.exe Token: SeTakeOwnershipPrivilege 5240 rundll32.exe Token: SeTcbPrivilege 5240 rundll32.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15288ebc036f65393c416249c28742ff24691cf5537e853b7142cbcef9cb9002.dll,#11⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5240
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵PID:1744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DQeTpIjxKkNnTsEQ.Qwq24-3-35
- Size 526KB
- SHA256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61
- MD5 10b3049f4a954665512eca5d24728c89
- SHA1 172c5ce3afab6d63fe12a7e036f20271b9d09c13
- SHA512 0e6e8a93bdc2f5523b05c77cfc110d91f3b0f7763500e4c9f60989aeb4d86805bc985e01779014df63a57e944e6d138a9fc3879bf26d853a1167c8c7193699d7
- SSDEEP 6144:mERwg6i21P20M6NqWhUOqLDtQrPxXfuEu1rHP3gk9fKgBb/PaeO:fwg6i21O0p49OwQr5mEu1N9ds
- TLSH T1C2B4B059D3A108A6F167D07FCAA7C55AEAB27888974086DF42B4CD855F27BF0F138342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DQeTpIjxKkNnTsEQ.Qwq24-3-35.pak
- Size 526KB
- SHA256 1149259132bfa53de9f728edcc8c8ac2906a459e2c52200ac0cbe7708bfbcdde
- MD5 4e5f2d6780402cf486bdcf1cd1f579d1
- SHA1 d44e896d1fb9214851c2bbf3c274f6aaa04cb8a6
- SHA512 1f2c55eb3ffb61ef678f21949aa8c4dda283a1d83a04f87c48eabff2e2636ca1132b0c67a8e9d46aa2572e98adef561b6caac7f60c0cbf9461add0e6b675175f
- SSDEEP 12288:M5/OUgMID2Q6vtHZKjbcV16htEahPPFeAGp44jzPlIiCuf:AOUcDwvt5qcaXE4PdAlfGibf
- TLSH T105B4239C4715E41B45D2FCAC76B6B4EEC8FAA03432A1A07A1D448F4C125EB7B9B1E6C4
- MD5 SHA1 SHA512 SSDEEP TLSH