3c110de70db7225573f6bd937a7704423bce6c03fad5fac3ea3fb5bacf130d50

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ce2872bda09b6cd891e8a12467f00d7.dll
Size 1.1MB
Sample260926-katn2aydmb
SHA256 3c110de70db7225573f6bd937a7704423bce6c03fad5fac3ea3fb5bacf130d50
MD5 8ce2872bda09b6cd891e8a12467f00d7
SHA1 11a990258000c0237e61f71a2c28e289849213b8
SHA512 50c09620c08b7189e73d9631a9cc33a0953bc0bb69788c740a6538e8764d6856e909e4f84dc12c5b5bdcbbb1c02a59f9bbc784bb5e0bf8d8ac5a3a2f91976328
SSDEEP 12288:d5O5lFRG/ds+YtIvexuMQQnIs/e0wnqjD8ZKLlv0h6r+8zvR1DMW:dclFRGu+Yjx993wg4s0gj7x
TLSH
T1EA353B0297BD026CE0EBE23C9A579912E63A780D43B15AEF078099632F567E1DF3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	5304	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe
5304	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5304	rundll32.exe
Token: SeImpersonatePrivilege	5304	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ce2872bda09b6cd891e8a12467f00d7.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads