Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9.dll
- Size 421KB
- Sample261007-3ma2kaht2p
- SHA256 37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9
- MD5 b590f0aa29d8c1ee7b51f5d844a8adba
- SHA1 efea4ccdb337e1543e2f02f151990b44c31540fe
- SHA512 aabf0e085292bf10ba7abd8b606b67c86b304c7ba9086a3b9d540410ce2cc492f0904568517725ea65584fe3c903a3cdab80b61d13237f678ce93f5630622392
- SSDEEP 6144:FwMJQ31pyS83caEzjM1pj9BfCBYWysJkJTBAOVr4g:GPiSaca8iBfCBYlsWJTmJ
- TLSH T158946D05FBE405A5E1B7A23CC9F38606E6727C4913618BCF236887991F33BD0A53A765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe - Checks processor information in registry 2 TTPs 32 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 rundll32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4948 rundll32.exe 4948 rundll32.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4948 rundll32.exe Token: SeSecurityPrivilege 4948 rundll32.exe Token: SeTakeOwnershipPrivilege 4948 rundll32.exe Token: SeLoadDriverPrivilege 4948 rundll32.exe Token: SeSystemProfilePrivilege 4948 rundll32.exe Token: SeSystemtimePrivilege 4948 rundll32.exe Token: SeProfSingleProcessPrivilege 4948 rundll32.exe Token: SeIncBasePriorityPrivilege 4948 rundll32.exe Token: SeCreatePagefilePrivilege 4948 rundll32.exe Token: SeBackupPrivilege 4948 rundll32.exe Token: SeRestorePrivilege 4948 rundll32.exe Token: SeShutdownPrivilege 4948 rundll32.exe Token: SeDebugPrivilege 4948 rundll32.exe Token: SeSystemEnvironmentPrivilege 4948 rundll32.exe Token: SeRemoteShutdownPrivilege 4948 rundll32.exe Token: SeUndockPrivilege 4948 rundll32.exe Token: SeManageVolumePrivilege 4948 rundll32.exe Token: 33 4948 rundll32.exe Token: 34 4948 rundll32.exe Token: 35 4948 rundll32.exe Token: 36 4948 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\37e97a8ba933101501eaf1a6d624038b4c7a19d137327c1afc596980231a27f9.dll,#11⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6024