Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 10:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll
- Size 8.0MB
- Sample260924-ml58babe22
- SHA256 b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b
- MD5 deb8d25af4233d30faf4fd291d5edf3e
- SHA1 f38f2b27e5b0babb1bff7779a3990ea7af6cfa8d
- SHA512 a94c77246f4293f04343df316abfe95d9c2c0768c2bfed1a27c29c182794fabafc5e5500c3493b8386a9190e05ec44f557669b15ece335971a1e53868a5959ba
- SSDEEP 196608:kIyWYz0PUrzo77nO9/jPbMGgJvu4O7NADtV6v+v:jy3X8O9rPQGT7
- TLSH T19686D0127D5C0067E45A2330CE58F2FCF77D6DA06B2300DB69A4BA1ABA71B415F1A35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
pid Process 1896 CMD.EXE 5020 oUeGxAZIhHmEqyerjOFlEiEtBfjippds.Kqd.exe 4908 CMD.EXE 4148 StmOTZLpfPTAdRcDWtKWDlMqIIIoAovZ.wrS.exe 5056 CMD.EXE 872 wimGhTEvEJhGZWRiAXCeJIuCrcXrwaxV.gqo.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.EXE - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/ImcVwZhNlPizwENPnGDXXhzoBiBhvPiP.cng/oUeGxAZIhHmEqyerjOFlEiEtBfjippds.Kqd.exe" rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/xibQVoqMrOGndHfleWidKFNXbRRgCKlQ.LRc/StmOTZLpfPTAdRcDWtKWDlMqIIIoAovZ.wrS.exe" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open\command\DelegateExecute rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/BrGTDfQYDmzYXHMuOCvLzoskcLoCmblD.HGC/wimGhTEvEJhGZWRiAXCeJIuCrcXrwaxV.gqo.exe" rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe 4512 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4512 rundll32.exe Token: SeLoadDriverPrivilege 4512 rundll32.exe Token: SeTakeOwnershipPrivilege 4512 rundll32.exe Token: SeIncBasePriorityPrivilege 4512 rundll32.exe Token: SeTcbPrivilege 4512 rundll32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4792 wrote to memory of 4512 4792 rundll32.exe 87 PID 4512 wrote to memory of 1896 4512 rundll32.exe 98 PID 1896 wrote to memory of 2020 1896 CMD.EXE 100 PID 2020 wrote to memory of 5020 2020 ComputerDefaults.exe 101 PID 4512 wrote to memory of 4908 4512 rundll32.exe 111 PID 4908 wrote to memory of 2204 4908 CMD.EXE 113 PID 2204 wrote to memory of 4148 2204 ComputerDefaults.exe 114 PID 4512 wrote to memory of 5056 4512 rundll32.exe 117 PID 5056 wrote to memory of 3692 5056 CMD.EXE 119 PID 3692 wrote to memory of 872 3692 ComputerDefaults.exe 120
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2a5203f35f123d299cdbb326da8f8944fc6fd0c2b70dc98e335c4eeedb9fd3b.dll,#12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\CMD.EXE/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\ProgramData\ImcVwZhNlPizwENPnGDXXhzoBiBhvPiP.cng\oUeGxAZIhHmEqyerjOFlEiEtBfjippds.Kqd.exe"oUeGxAZIhHmEqyerjOFlEiEtBfjippds.Kqd.exe"5⤵
- Executes dropped EXE
PID:5020
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CMD.EXE/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\ProgramData\xibQVoqMrOGndHfleWidKFNXbRRgCKlQ.LRc\StmOTZLpfPTAdRcDWtKWDlMqIIIoAovZ.wrS.exe"StmOTZLpfPTAdRcDWtKWDlMqIIIoAovZ.wrS.exe"5⤵
- Executes dropped EXE
PID:4148
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CMD.EXE/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\ProgramData\BrGTDfQYDmzYXHMuOCvLzoskcLoCmblD.HGC\wimGhTEvEJhGZWRiAXCeJIuCrcXrwaxV.gqo.exe"wimGhTEvEJhGZWRiAXCeJIuCrcXrwaxV.gqo.exe"5⤵
- Executes dropped EXE
PID:872
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\BrGTDfQYDmzYXHMuOCvLzoskcLoCmblD.HGC\PdfcOre8.dlL
- Size 2.7MB
- SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
- MD5 055ad262789ca2d30c448078978b5169
- SHA1 fa91b5786a1340b85b088447f74606629ea38a67
- SHA512 0e5cb94ed4a6548c19966aa73fc9cbef4058b78ff130d18d0f801d27efb66e3bc05444c6bbdd3d2066d3ba4e89fcd9d506cc588054a61501290ba925dd3b7757
- SSDEEP 49152:jHwJkCu76S+cdUb3YR0hrkOWwkWIiLrvHhBWo4LYrL4M8enc7XWI+MSYzGb2LMfp:jHwaCdfcdUbK0hh3kWIiLrh/4LYrLN8o
- TLSH T15DD59E123B440077F91E42B0994DB3A8F2BC6DF0077943D76AD4DA2CA9728C296757AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\BrGTDfQYDmzYXHMuOCvLzoskcLoCmblD.HGC\PdfcOre8.dlL.rtf
- Size 2.7MB
- SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
- MD5 c3e4ae9287908794f17b52c377a72212
- SHA1 1fe3f351556aa478fa52f852fffeda4bc134a973
- SHA512 94591a6bfcf8a0edc51f34c5abe88e737a755cfe85d3c29377137cdae1fc1260e0fa07928d9cc7924670651306dc6433e816ee12e17985ccdd1fc26fc7ed08d2
- SSDEEP 49152:hZx9qZtOEaBU5OfP5z+9S+9n/UfNgt0qQto3VpbayAlvdK7vHztbuJi:h9qZ+BtQ9n/j3VpbaLfCvHgJi
- TLSH T1B3D5336935082121AC361C5A6C410FEDF3A0657CEA8B43FB392610EF9C7D9A7DED605B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ImcVwZhNlPizwENPnGDXXhzoBiBhvPiP.cng\oUeGxAZIhHmEqyerjOFlEiEtBfjippds.Kqd.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\CMD.EXE
- Size 231KB
- SHA256 4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
- MD5 d0fce3afa6aa1d58ce9fa336cc2b675b
- SHA1 4048488de6ba4bfef9edf103755519f1f762668f
- SHA512 80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
- SSDEEP 6144:i4VU52dn+OAdUV0RzCcXkThYrK9qqUtmtime:i4K2B+Ob2h0NXIn
- TLSH T145346C52A648A0B1CA623174567AFF369D7EFC70871252C7B7F05DAB78A01C0B63D31A
- MD5 SHA1 SHA512 SSDEEP TLSH