Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/09/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff5c63c88e165d842ca962c442dc6199e56f544b00d24c0580783771814f456e.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff5c63c88e165d842ca962c442dc6199e56f544b00d24c0580783771814f456e.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target ff5c63c88e165d842ca962c442dc6199e56f544b00d24c0580783771814f456e.dll
- Size 7.9MB
- Sample260928-e7bltsvdjc
- SHA256 ff5c63c88e165d842ca962c442dc6199e56f544b00d24c0580783771814f456e
- MD5 ca32650fad1fbf4e6887c9c29b563191
- SHA1 4d3d3a0c43d5e5a2c09624005dff0a21fa2cb333
- SHA512 69e2a911603912595e49ab4dbd4dd19b13e517c51d9f87fcea25e1f79c94866c1792cf4f5edeebe315e36ee319a9a140c1d5e339a4e8d58b7406f073ccc26702
- SSDEEP 196608:SLKUlnsEJeZIa2ryhtnO9/jPbMGgJvu4O7NADtV6v+:mxlNK/O9rPQGT7
- TLSH T1A586E11A3D5C106BD03A3330CE98A2F8F7AEAD607A67045739F4B91EA679F013E0555B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 4420 JUJGqDACpzRmpUrvnIbWzuhgANvYZdJy.pIw.exe 4092 XiBMFbIgBAAhGQYUGXVtIQHxPVSUoBin.ZUi.exe 3940 oWRVOvuESZtSbOPlSRcjtFkGUbKATUHo.GrP.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/PrEWatimKDErggRwrKAfFxmUNJxjiORa.Vnk/JUJGqDACpzRmpUrvnIbWzuhgANvYZdJy.pIw.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open\command\DelegateExecute rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/ZAcQnNEorRPPTddwpKtQOlaANNuzIxDF.ons/XiBMFbIgBAAhGQYUGXVtIQHxPVSUoBin.ZUi.exe" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/dsPUpFvvNdWtMowBbuIQpPXagKxQqOqI.FtH/oWRVOvuESZtSbOPlSRcjtFkGUbKATUHo.GrP.exe" rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe 3860 rundll32.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3860 rundll32.exe Token: SeLoadDriverPrivilege 3860 rundll32.exe Token: SeTakeOwnershipPrivilege 3860 rundll32.exe Token: SeIncBasePriorityPrivilege 3860 rundll32.exe Token: SeTcbPrivilege 3860 rundll32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1244 wrote to memory of 3860 1244 rundll32.exe 87 PID 3860 wrote to memory of 212 3860 rundll32.exe 98 PID 212 wrote to memory of 2924 212 cmd.exe 100 PID 2924 wrote to memory of 4420 2924 ComputerDefaults.exe 101 PID 3860 wrote to memory of 2400 3860 rundll32.exe 113 PID 2400 wrote to memory of 3864 2400 cmd.exe 115 PID 3864 wrote to memory of 4092 3864 ComputerDefaults.exe 116 PID 3860 wrote to memory of 3284 3860 rundll32.exe 118 PID 3284 wrote to memory of 3944 3284 cmd.exe 120 PID 3944 wrote to memory of 3940 3944 ComputerDefaults.exe 121
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5c63c88e165d842ca962c442dc6199e56f544b00d24c0580783771814f456e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5c63c88e165d842ca962c442dc6199e56f544b00d24c0580783771814f456e.dll,#12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\ProgramData\PrEWatimKDErggRwrKAfFxmUNJxjiORa.Vnk\JUJGqDACpzRmpUrvnIbWzuhgANvYZdJy.pIw.exe"JUJGqDACpzRmpUrvnIbWzuhgANvYZdJy.pIw.exe"5⤵
- Executes dropped EXE
PID:4420
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\ProgramData\ZAcQnNEorRPPTddwpKtQOlaANNuzIxDF.ons\XiBMFbIgBAAhGQYUGXVtIQHxPVSUoBin.ZUi.exe"XiBMFbIgBAAhGQYUGXVtIQHxPVSUoBin.ZUi.exe"5⤵
- Executes dropped EXE
PID:4092
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\ProgramData\dsPUpFvvNdWtMowBbuIQpPXagKxQqOqI.FtH\oWRVOvuESZtSbOPlSRcjtFkGUbKATUHo.GrP.exe"oWRVOvuESZtSbOPlSRcjtFkGUbKATUHo.GrP.exe"5⤵
- Executes dropped EXE
PID:3940
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\PrEWatimKDErggRwrKAfFxmUNJxjiORa.Vnk\JUJGqDACpzRmpUrvnIbWzuhgANvYZdJy.pIw.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\dsPUpFvvNdWtMowBbuIQpPXagKxQqOqI.FtH\pdFCorE8.Dll
- Size 2.7MB
- SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
- MD5 055ad262789ca2d30c448078978b5169
- SHA1 fa91b5786a1340b85b088447f74606629ea38a67
- SHA512 0e5cb94ed4a6548c19966aa73fc9cbef4058b78ff130d18d0f801d27efb66e3bc05444c6bbdd3d2066d3ba4e89fcd9d506cc588054a61501290ba925dd3b7757
- SSDEEP 49152:jHwJkCu76S+cdUb3YR0hrkOWwkWIiLrvHhBWo4LYrL4M8enc7XWI+MSYzGb2LMfp:jHwaCdfcdUbK0hh3kWIiLrh/4LYrLN8o
- TLSH T15DD59E123B440077F91E42B0994DB3A8F2BC6DF0077943D76AD4DA2CA9728C296757AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\dsPUpFvvNdWtMowBbuIQpPXagKxQqOqI.FtH\pdFCorE8.Dll.rtf
- Size 2.7MB
- SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
- MD5 c3e4ae9287908794f17b52c377a72212
- SHA1 1fe3f351556aa478fa52f852fffeda4bc134a973
- SHA512 94591a6bfcf8a0edc51f34c5abe88e737a755cfe85d3c29377137cdae1fc1260e0fa07928d9cc7924670651306dc6433e816ee12e17985ccdd1fc26fc7ed08d2
- SSDEEP 49152:hZx9qZtOEaBU5OfP5z+9S+9n/UfNgt0qQto3VpbayAlvdK7vHztbuJi:h9qZ+BtQ9n/j3VpbaLfCvHgJi
- TLSH T1B3D5336935082121AC361C5A6C410FEDF3A0657CEA8B43FB392610EF9C7D9A7DED605B
- MD5 SHA1 SHA512 SSDEEP TLSH