Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/09/2026, 12:26
General
- Target lighttpd/cyggssapi_krb5-2.dll
- Size 116KB
- Sample260925-pmlleaea93
- SHA256 e4b2602bf2dfd5d688892cc7b052f1d4e97946d21c45a94714f7680d6104ccf9
Malware Config
Signatures
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lighttpd\cyggssapi_krb5-2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lighttpd\cyggssapi_krb5-2.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4808-1-0x00000000567B0000-0x00000000567C4000-memory.dmp
memory/4808-3-0x0000000055F90000-0x0000000055FA4000-memory.dmp
memory/4808-2-0x0000000065150000-0x000000006515F000-memory.dmp
memory/4808-0-0x00000000628E0000-0x0000000062937000-memory.dmp
memory/4808-16-0x0000000065150000-0x000000006515F000-memory.dmp
memory/4808-22-0x0000000061000000-0x00000000614B0000-memory.dmp
memory/4808-21-0x0000000055FB0000-0x000000005608D000-memory.dmp
memory/4808-20-0x00000000628E0000-0x0000000062937000-memory.dmp
memory/4808-19-0x0000000055F90000-0x0000000055FA4000-memory.dmp
memory/4808-17-0x00000000567B0000-0x00000000567C4000-memory.dmp
memory/4808-8-0x0000000064060000-0x0000000064085000-memory.dmp
memory/4808-5-0x00000000561A0000-0x00000000561E2000-memory.dmp
memory/4808-4-0x0000000055FB0000-0x000000005608D000-memory.dmp
memory/4808-18-0x0000000061E30000-0x0000000061F38000-memory.dmp