Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
07/11/2026, 17:52
General
- Target mn.dll
- Size 14.8MB
- Sample261107-wf7cvsfe68
- SHA256 1084b02f92d51a10112e0ac3056658fffe87c5cd6d587324cc09061df15fcc4e
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mn.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mn.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1780-0-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-9-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/1780-12-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/1780-13-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/1780-14-0x0000000005290000-0x0000000005291000-memory.dmp
memory/1780-15-0x00000000052A0000-0x00000000052A1000-memory.dmp
memory/1780-16-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/1780-17-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/1780-18-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/1780-20-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-22-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-24-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-25-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-26-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-27-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-28-0x0000000010000000-0x0000000010F3D000-memory.dmp
memory/1780-30-0x0000000010000000-0x0000000010F3D000-memory.dmp