b61c53f4137c41aa0a5538fc9a746034b3a903cc4b1b3c8b5f3d3118e1e2bd8f

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[email protected]
Size 1.4MB
Sample260930-fw33dazblg
SHA256 b61c53f4137c41aa0a5538fc9a746034b3a903cc4b1b3c8b5f3d3118e1e2bd8f
MD5 e1b69c058131e1593eccd4fbcdbb72b2
SHA1 6d319439cac072547edd7cf2019855fa25092006
SHA512 161a5923dc3a6507cbee3b547edcef4fbfe1dc6a04832c2472b1e635d758d1503a61361c2a83a13a0d8e4607516fda4ae6462a74df66b20a7c93174bbcc7129c
SSDEEP 24576:yYzpj9/AteBV+n/yETaXh8Nv9Xx5/ttAoRfwAy+/CxCWfxBcMkC9e327kY:djRAK+6Fh8zPvrRISCxt5q3SA
TLSH
T15765016739D290B5D7428DF6CE0972DF2FA9172C122A55EEF3AC1091F6B0871E0A506F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	2476	rundll32.exe
9	5728	rundll32.exe
11	5728	rundll32.exe
12	5728	rundll32.exe
14	5728	rundll32.exe
15	5728	rundll32.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ad793386-8b61-4548-b669-ca1644b7dfba_31.lnk	[email protected]

Loads dropped DLL 3 IoCs

pid	Process
4124	[email protected]
2476	rundll32.exe
5728	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ad793386-8b61-4548-b669-ca1644b7dfba_31 = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\ProgramData\\ad793386-8b61-4548-b669-ca1644b7dfba_31.avi\", start "	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\ad793386-8b61-4548-b669-ca1644b7dfba_31 = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\ProgramData\\ad793386-8b61-4548-b669-ca1644b7dfba_31.avi\", start "	[email protected]

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ad793386-8b61-4541-b669-ca1644b7dfba}	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ad793386-8b61-4541-b669-ca1644b7dfba}\NoExplorer = "1"	[email protected]

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Security Defender\Security Defender.dll	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	[email protected]
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ad793386-8b61-4541-b669-ca1644b7dfba}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ad793386-8b61-4541-b669-ca1644b7dfba}\ = "{ad793386-8b61-4541-b669-ca1644b7dfba}"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ad793386-8b61-4541-b669-ca1644b7dfba}\InProcServer32	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ad793386-8b61-4541-b669-ca1644b7dfba}\InProcServer32\ = "C:\\ProgramData\\ad793386-8b61-4548-b669-ca1644b7dfba_31.avi"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ad793386-8b61-4541-b669-ca1644b7dfba}\InProcServer32\ThreadingModel = "Apartment"	[email protected]

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4124	[email protected]
4124	[email protected]
4124	[email protected]
4124	[email protected]
5728	rundll32.exe
5728	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4124	[email protected]

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	[email protected]
Token: 33	2324	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2324	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4124	[email protected]
4124	[email protected]
4124	[email protected]
4124	[email protected]
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5728	rundll32.exe
5728	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2476	4124	[email protected]	89
PID 2476 wrote to memory of 5728	2476	rundll32.exe	91

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\ProgramData\ad793386-8b61-4548-b669-ca1644b7dfba_31.avi", start
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\wrk51EF.tmp", start worker
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:5728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:3852

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ins48F7.tmp

Path C:\Users\Admin\AppData\Local\Temp\ins48F7.tmp
Size 1.0MB
SHA256 fc39787ed00844c37694ac4a6570dafa494be52b16d1453a03adaebf4ee49d41
MD5 03de9e8c4b14a5ae459d4c5900eaa7ff
SHA1 7d36e4181d052c7555589561f93758d59b9d50f6
SHA512 9351b90a0bf6ae74af680f861e361c0f6b1b8ff49818e56c6d2eca5755e035c04d2159ffac6f0df6e76bd2a0be1b5a07ebf4678ff8c862bc3f5ee0719a85eaaf
SSDEEP 24576:d9vIVaUOjwPnH07YsLznrfgHop3OzUEmfz3XtnrhN/4HbA3TZ1H:uaUgHfnDguJEmb1L/47kJ
TLSH
T1E835CE3E61CC257CD7BEBAB78939320F5E3B9A943D11ED26A21DFB61E9B4406C4C0142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-19-0x0000000002EB0000-0x0000000002F71000-memory.dmp

Download

memory/2476-21-0x0000000002EB0000-0x0000000002F71000-memory.dmp

Download

memory/4124-0-0x0000000000B80000-0x0000000000CC7000-memory.dmp

Download

memory/4124-5-0x0000000003B90000-0x0000000003C51000-memory.dmp

Download

memory/4124-16-0x0000000000F20000-0x0000000001094000-memory.dmp

Download

memory/4124-18-0x0000000003B90000-0x0000000003C51000-memory.dmp

Download

memory/4124-17-0x0000000000B80000-0x0000000000CC7000-memory.dmp

Download

memory/5728-22-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-23-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-24-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-26-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-25-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-27-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-28-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-29-0x0000000002350000-0x0000000002411000-memory.dmp

Download

memory/5728-30-0x0000000002350000-0x0000000002411000-memory.dmp

Download