Analysis
- max time kernel
9s - max time network
34s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
01/10/2026, 20:47
General
- Target Noise+.dll
- Size 7.9MB
- Sample261001-zlbd6aydpc
- SHA256 6be3eef8485ebf3def65b04a1d2c05215421293bdc130fe0882ee3dfb1554022
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Noise+.dll,#11⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/W9RwQXvnPnQ2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ff88f46c188,0x7ff88f46c194,0x7ff88f46c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,7542255359407115557,6573375277782786859,262144 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,10756212850611640446,9013371733959329649,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,16062143198620283005,4572497683268499060,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14288336848683104145,11315785838444599162,2097152 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,412418637518470380,13909564181507294895,2097152 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,3146849371639541378,4559395128536858708,2097152 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,14249161326940829205,826712360881147955,2097152 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10719102122687809088,8413885568518150867,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,388095692754735980,15383478350556113757,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5504,i,6780777660079701302,5141532947630089022,2097152 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,17934760045785815141,16186836266612403544,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,8355500637794299101,1418098462006414710,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6012,i,7003280128139367860,16872342794892036794,2097152 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,11536327807075062026,3034993751211686577,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,16513415875413055127,608951751522703764,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,9716993248005887524,5212821212067790740,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,9716993248005887524,5212821212067790740,524288 --field-trial-handle=2868,i,16871832411588366942,15881157550381541684,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:83⤵
-
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\setup.msi" /quiet /qn /norestart2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\system32\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Shared\04fa8a72\RegisterAgent.cmd""2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\xcopy.exexcopy /E /I /Y /Q /H /R "C:\Users\Admin\AppData\Local\Shared\04fa8a72\*" "C:\Users\Admin\AppData\Local\Core\a109dcb6\"3⤵
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /E /I /Y /Q /H /R "C:\Users\Admin\AppData\Local\Shared\04fa8a72\*" "C:\Users\Admin\AppData\Local\Helpers\c44cc00c\"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "AutoBroker569538d1" /XML "C:\Users\Admin\AppData\Local\Temp\r16910.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "SyncAgentdc2dacc4" /XML "C:\Users\Admin\AppData\Local\Temp\r16910.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Local\Helpers\c44cc00c\VideoProc9.exe" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}" /v wde72 /t REG_SZ /d "FILE:C:\Users\Admin\AppData\Local\Shared\04fa8a72" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}" /v w5a78 /t REG_SZ /d "FILE:C:\Users\Admin\AppData\Local\Core\a109dcb6" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Classes\CLSID\{e43134f9-ae5c-0c3f-6096-539dd80620a0}" /v wdd3e /t REG_SZ /d "FILE:C:\Users\Admin\AppData\Local\Helpers\c44cc00c" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exe"C:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exe"2⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN "AutoBroker569538d1" /XML "C:\Users\Admin\AppData\Local\Temp\AutoBroker569538d1.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN "SyncAgentdc2dacc4" /XML "C:\Users\Admin\AppData\Local\Temp\SyncAgentdc2dacc4.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Core\a109dcb6\VideoProc9.exeC:\Users\Admin\AppData\Local\Core\a109dcb6\VideoProc9.exe1⤵
-
C:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exeC:\Users\Admin\AppData\Local\Shared\04fa8a72\VideoProc9.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e586e29.rbs
03bd0852-b09f-4075-b0dc-02932c2fc34f.tmp
72675f5e-c6ca-4a7e-be24-ed0d0b0ceabf.tmp
791097e6-2dc2-4c82-bc5b-f5608a671797.tmp
settings.dat
settings.dat
620fc0cf-28cc-4300-96a6-d3b9a56c0ae8.tmp
6bc1b172-a617-45e1-85cd-edaad7bda0c8.tmp
f_000067
CURRENT
MANIFEST-000001
249e07d0-3834-42d1-8dc3-80079a501b0d.tmp
fcc9e6e6-f1f9-4870-ac70-4db4c53c9422.tmp
index.txt
index.txt.tmp
index.txt.tmp
bc21d45b-c8b4-49cb-9b1d-617119dca851.tmp
6deb534f-7b0f-4f0f-800e-df092381e5be.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
hash[1].txt
discord[1].txt
sumhash[1].txt
RegisterAgent.cmd
VideoProc9.exe
igfx_splash.png
libmfx64-gen.dll
msvcp140.dll
readme.txt
vcruntime140.dll
vcruntime140_1.dll
59232ad9-181f-43bb-b545-4d73f63f5ad3.tmp
5d67e3d0-947a-4c54-9e62-fbd9508b9b80.tmp
AutoBroker569538d1.xml
SyncAgentdc2dacc4.xml
scr.png
dbg_log.txt
dbg_log.txt
dbg_log.txt
r16910.xml
setup.msi
e586e26.msi
memory/2000-475-0x00007FF88B310000-0x00007FF88B34F000-memory.dmp
memory/2000-474-0x00007FF88B350000-0x00007FF88B38F000-memory.dmp
memory/2000-476-0x00007FF88B2D0000-0x00007FF88B30F000-memory.dmp
memory/2776-6-0x00007FF8AB660000-0x00007FF8AB662000-memory.dmp
memory/2776-12-0x00007FF890430000-0x00007FF89169A000-memory.dmp
memory/2776-64-0x00007FF890BD2000-0x00007FF890EB9000-memory.dmp
memory/2776-61-0x0000012720E50000-0x0000012720EF9000-memory.dmp
memory/2776-103-0x00007FF890430000-0x00007FF89169A000-memory.dmp
memory/2776-0-0x00007FF890BD2000-0x00007FF890EB9000-memory.dmp
memory/2776-1-0x00007FF8ADE10000-0x00007FF8ADE12000-memory.dmp
memory/2776-3-0x00007FF8ADE30000-0x00007FF8ADE32000-memory.dmp
memory/2776-24-0x00007FF890430000-0x00007FF89169A000-memory.dmp
memory/2776-450-0x00007FF890430000-0x00007FF89169A000-memory.dmp
memory/2776-7-0x00007FF8AB670000-0x00007FF8AB672000-memory.dmp
memory/2776-4-0x00007FF8AD520000-0x00007FF8AD522000-memory.dmp
memory/2776-2-0x00007FF8ADE20000-0x00007FF8ADE22000-memory.dmp
memory/2776-62-0x0000012720470000-0x00000127204D9000-memory.dmp
memory/2776-5-0x00007FF8AD530000-0x00007FF8AD532000-memory.dmp
memory/2776-13-0x00007FF85E590000-0x00007FF85E5A0000-memory.dmp
memory/5484-445-0x000002166BA20000-0x000002166C6E2000-memory.dmp
memory/5484-386-0x000002166BA20000-0x000002166C6E2000-memory.dmp
memory/5484-347-0x000002166AD60000-0x000002166BA1E000-memory.dmp
memory/5484-444-0x000002166BA20000-0x000002166C6E2000-memory.dmp
memory/5484-308-0x000002166A0A0000-0x000002166AD5D000-memory.dmp
memory/5572-470-0x00007FF88ABC0000-0x00007FF88ABFF000-memory.dmp
memory/5572-471-0x00007FF88AB80000-0x00007FF88ABBF000-memory.dmp
memory/5572-472-0x00007FF88AB40000-0x00007FF88AB7F000-memory.dmp