Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll
- Size 7.9MB
- Sample260925-prswaastf1
- SHA256 293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446
- MD5 c450d6e81cb01f8fceab81f943684a9a
- SHA1 ca71fe2774b1fa9e10babba7aef5c4932b40cafa
- SHA512 ffee8391bacb576e71343993d93103df36e5ec8ba7721dfccd86523f7adec42cdcdec924f5944886309a36c9349c24d83c5cfd242b8e6163bdfb3e8fead8a503
- SSDEEP 196608:SLKUlnsEJeZIa9ryhtnO9/jPbMGgJvu4O7NADtV6v+:mxlN1/O9rPQGT7
- TLSH T1DD86E11A3D5C106BD03A3330CE98A2F8F7AEAD607A67045739F4B91EA679F013E0555B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2664 OtchXYNqsvVOYFJViXgJURgfOItOMvCz.nCg.exe 2064 WWWdblhOFwfFEdHUjZLsnyzewKHNfKVF.IGG.exe 2552 NzSOLFUeBzDtqtcBMfUKURVgeUOKsFsX.pxi.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/NkIxRMVwvlxBhezrJHjOUkQQWCQlrRCQ.mcs/OtchXYNqsvVOYFJViXgJURgfOItOMvCz.nCg.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open\command\DelegateExecute rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/NNrrMhfwAiuXlZQAmcHwpBlgubxYTDOt.uVz/WWWdblhOFwfFEdHUjZLsnyzewKHNfKVF.IGG.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/heiTWyHvGKmMcnaWfHtEWaWKlXDeesZB.BWV/NzSOLFUeBzDtqtcBMfUKURVgeUOKsFsX.pxi.exe" rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2260 rundll32.exe Token: SeLoadDriverPrivilege 2260 rundll32.exe Token: SeTakeOwnershipPrivilege 2260 rundll32.exe Token: SeIncBasePriorityPrivilege 2260 rundll32.exe Token: SeTcbPrivilege 2260 rundll32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2260 2564 rundll32.exe 87 PID 2260 wrote to memory of 2424 2260 rundll32.exe 100 PID 2424 wrote to memory of 2656 2424 cmd.exe 102 PID 2656 wrote to memory of 2664 2656 ComputerDefaults.exe 103 PID 2260 wrote to memory of 1856 2260 rundll32.exe 113 PID 1856 wrote to memory of 3380 1856 cmd.exe 115 PID 3380 wrote to memory of 2064 3380 ComputerDefaults.exe 116 PID 2260 wrote to memory of 4944 2260 rundll32.exe 122 PID 4944 wrote to memory of 4520 4944 cmd.exe 124 PID 4520 wrote to memory of 2552 4520 ComputerDefaults.exe 125
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll,#12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\ProgramData\NkIxRMVwvlxBhezrJHjOUkQQWCQlrRCQ.mcs\OtchXYNqsvVOYFJViXgJURgfOItOMvCz.nCg.exe"OtchXYNqsvVOYFJViXgJURgfOItOMvCz.nCg.exe"5⤵
- Executes dropped EXE
PID:2664
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\ProgramData\NNrrMhfwAiuXlZQAmcHwpBlgubxYTDOt.uVz\WWWdblhOFwfFEdHUjZLsnyzewKHNfKVF.IGG.exe"WWWdblhOFwfFEdHUjZLsnyzewKHNfKVF.IGG.exe"5⤵
- Executes dropped EXE
PID:2064
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\ProgramData\heiTWyHvGKmMcnaWfHtEWaWKlXDeesZB.BWV\NzSOLFUeBzDtqtcBMfUKURVgeUOKsFsX.pxi.exe"NzSOLFUeBzDtqtcBMfUKURVgeUOKsFsX.pxi.exe"5⤵
- Executes dropped EXE
PID:2552
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NkIxRMVwvlxBhezrJHjOUkQQWCQlrRCQ.mcs\OtchXYNqsvVOYFJViXgJURgfOItOMvCz.nCg.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\heiTWyHvGKmMcnaWfHtEWaWKlXDeesZB.BWV\pdFCoRe8.dll
- Size 2.7MB
- SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
- MD5 055ad262789ca2d30c448078978b5169
- SHA1 fa91b5786a1340b85b088447f74606629ea38a67
- SHA512 0e5cb94ed4a6548c19966aa73fc9cbef4058b78ff130d18d0f801d27efb66e3bc05444c6bbdd3d2066d3ba4e89fcd9d506cc588054a61501290ba925dd3b7757
- SSDEEP 49152:jHwJkCu76S+cdUb3YR0hrkOWwkWIiLrvHhBWo4LYrL4M8enc7XWI+MSYzGb2LMfp:jHwaCdfcdUbK0hh3kWIiLrh/4LYrLN8o
- TLSH T15DD59E123B440077F91E42B0994DB3A8F2BC6DF0077943D76AD4DA2CA9728C296757AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\heiTWyHvGKmMcnaWfHtEWaWKlXDeesZB.BWV\pdFCoRe8.dll.rtf
- Size 2.7MB
- SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
- MD5 c3e4ae9287908794f17b52c377a72212
- SHA1 1fe3f351556aa478fa52f852fffeda4bc134a973
- SHA512 94591a6bfcf8a0edc51f34c5abe88e737a755cfe85d3c29377137cdae1fc1260e0fa07928d9cc7924670651306dc6433e816ee12e17985ccdd1fc26fc7ed08d2
- SSDEEP 49152:hZx9qZtOEaBU5OfP5z+9S+9n/UfNgt0qQto3VpbayAlvdK7vHztbuJi:h9qZ+BtQ9n/j3VpbaLfCvHgJi
- TLSH T1B3D5336935082121AC361C5A6C410FEDF3A0657CEA8B43FB392610EF9C7D9A7DED605B
- MD5 SHA1 SHA512 SSDEEP TLSH