86b3d13626912b40defc015080d62b05283e6dc7e43d5b9f9fca233b877d1d38

Analysis

user interaction
yes
max time kernel
22s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nigger.dll
Size 108KB
Sample261107-xvrrdsft3j
SHA256 86b3d13626912b40defc015080d62b05283e6dc7e43d5b9f9fca233b877d1d38
MD5 298930eab73da8f1e742f4d61ee63257
SHA1 437aded13dae77f950546dc647e8472b2845a927
SHA512 e8d56e289907c253d746cfa3072014e09963b53ea79c8d6727dcb20a16c1adaeb757cc1e73198cd9551855cf2b611a5c2ed627b95d163bb32739880c92218046
SSDEEP 3072:ytgPSbXHfuXz4cKg1qf5hHUYUKvVbERtXna:ywkcK9cYbV3
TLSH
T1E1B302B6F366C66AE013067401432FA8F452AE444B63A2EF5EFDF71F8D781D049B6921
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3060	powershell.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nigger.dll,#1
1⤵
PID:4052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\2a1535f3.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads