Analysis
- user interaction
yes - max time kernel
127s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/10/2026, 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target Payload.exe
- Size 1.4MB
- Sample261016-2wewfasvbv
- SHA256 d6dbb65bc9f4f7a66c8cb3aa4f2ab9831a15c4b4c1d30ff8739be263dff5a3f2
- MD5 276027523c030ec2ae2234e0c00d446c
- SHA1 7cf579fb604f77b5bbb3d25719447b976c39203a
- SHA512 5c26e36e9b8deb2e9522eff1dd12f3ced6acbc4d51c327d972881dee352679e81c255c0f5374563ba1c680133de89947adf577d34a2b0b2137f1ed55adef0d9f
- SSDEEP 24576:udmORvZ6kpw9d7+NH8ksyt6fTBEEyyhUgUKSI3h+1:udmOvi99+Ncmt631UKSI3Q
- TLSH T1BD65E70DF9B67E12CA7C027BD21394FC01D3A5587702D2DBAAE52AC51F1ABADCDCA444
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e25c6cb9cf3a9676f1451a28468ad57.exe dllhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e25c6cb9cf3a9676f1451a28468ad57.exe dllhost.exe - Executes dropped EXE 1 IoCs
pid Process 2128 dllhost.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 dllhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 972 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dllhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dllhost.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Kills process with taskkill 1 IoCs
pid Process 6128 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe 2128 dllhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2128 dllhost.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 6128 taskkill.exe Token: SeDebugPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe Token: 33 2128 dllhost.exe Token: SeIncBasePriorityPrivilege 2128 dllhost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5780 wrote to memory of 2128 5780 Payload.exe 89 PID 2128 wrote to memory of 972 2128 dllhost.exe 90 PID 972 wrote to memory of 6128 972 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\dllhost.exe"C:\Users\Admin\dllhost.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im Wireshark.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Wireshark.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\dllhost.exe
- Size 1.4MB
- SHA256 d6dbb65bc9f4f7a66c8cb3aa4f2ab9831a15c4b4c1d30ff8739be263dff5a3f2
- MD5 276027523c030ec2ae2234e0c00d446c
- SHA1 7cf579fb604f77b5bbb3d25719447b976c39203a
- SHA512 5c26e36e9b8deb2e9522eff1dd12f3ced6acbc4d51c327d972881dee352679e81c255c0f5374563ba1c680133de89947adf577d34a2b0b2137f1ed55adef0d9f
- SSDEEP 24576:udmORvZ6kpw9d7+NH8ksyt6fTBEEyyhUgUKSI3h+1:udmOvi99+Ncmt631UKSI3Q
- TLSH T1BD65E70DF9B67E12CA7C027BD21394FC01D3A5587702D2DBAAE52AC51F1ABADCDCA444
- MD5 SHA1 SHA512 SSDEEP TLSH