Analysis
- user interaction
yes - max time kernel
115s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
r6_internal_113.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
60 seconds
Behavioral task
behavioral2
Sample
r6_internal_113.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
60 seconds
General
- Target r6_internal_113.dll
- Size 2.7MB
- Sample261009-2e83ysft7z
- SHA256 98c239e6eaaf4a455beaec3a86d2e5774a8e70375e42da8a7e62d15f6c0f06b4
- MD5 a3dc5779cc553d2a72f4a5f92e653b92
- SHA1 17a44d98b1f622da95c8a273bedd7dab0feb92b3
- SHA512 d20e22d6bb838e426d097ab6fc2cf8a8ae83db36902d6460599c696c5a8f2c8d5e1c562ee49bd3d61e8caa73299943af4814298cd6644405c4d348abe01986c2
- SSDEEP 49152:PycJQ8S95fGFgbiUL5mdbnQ2ZK5kAECgH7iAlTf47557P:65u+5kAECgH+kf857P
- TLSH T1D5D5C003F365C2ADC42A683486E6DB97F77578401B1485CB73992A589FA73F00BBB2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 4568 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4568 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4568 SearchIndexer.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\r6_internal_113.dll,#11⤵PID:4760
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2044
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4568 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:6108
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:3368
-