Overview
overview
10Static
static
3537821-WT3...df.exe
windows10-2004-x64
10537821-WT3...df.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
1$PLUGINSDI...fo.dll
windows10-2004-x64
1$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/11/2026, 11:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
537821-WT3270921778-20261109.Pdf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
537821-WT3270921778-20261109.Pdf.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 537821-WT3270921778-20261109.Pdf.exe
- Size 784KB
- Sample261109-nbbrdseg88
- SHA256 b449b477af4d9600038d2f24f6beba5c92e4905ac3b69614a394afbf77e71f08
- MD5 6aeefa466ba2e6c9b12b9d403d34633b
- SHA1 71c2a689afdcf4615cd987645d1698ef69cb4166
- SHA512 ceca241e64fae2bdc471f920d377283f0edca7d03aa9ec6f3955b36d462d4511e86c47fa34774aea88eb0a847056e0c19c2c3b3b97073fcaeb1735513cc67a42
- SSDEEP 24576:JMOm5yyujRNXV7Z0LjhjMWM+sKGDa9V2Ip:2KyujRNF7ZsjhjZMdKGGZp
- TLSH T1EA051209FEC7B8EADEF541747EF6C1726311BCA84014925E16A8BE3F7D3A253C826904
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
pid Process 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Subprimary = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Lysolecithin\\Modstillendes.exe" 537821-WT3270921778-20261109.Pdf.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
pid Process 4104 537821-WT3270921778-20261109.Pdf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4104 537821-WT3270921778-20261109.Pdf.exe 4104 537821-WT3270921778-20261109.Pdf.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4104 wrote to memory of 3540 4104 537821-WT3270921778-20261109.Pdf.exe 89 PID 4104 wrote to memory of 3540 4104 537821-WT3270921778-20261109.Pdf.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\537821-WT3270921778-20261109.Pdf.exe"C:\Users\Admin\AppData\Local\Temp\537821-WT3270921778-20261109.Pdf.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe"2⤵PID:3540
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Pillow.ini
- Size 78B
- SHA256 45375a9917ea9106b3889c7a232663c90a7eaf8f3bf7ba5a2e6266e86087346a
- MD5 0ed04ecd771987b902d6fce588ae0bcb
- SHA1 31186fec202b348eb10842a430d484b221e6580c
- SHA512 3b7dc64b918ff006306afddbe6d86f880026bf36c73062482b3e86af0d7a48d34d582e8e54d534a8996cb29d63755b59f29fac926caa4a2c0c357b7271d7a52e
- TLSH T1ABA0220288E0000080E2C3B308A0CA222003200BA0CF0803323CC0A0C30AB32C00F882
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Pillow.ini
- Size 52B
- SHA256 903283f80a2ea8a8f8723d811f3a0dad2defa4acbd3ab2b8ddf69b2293d42d98
- MD5 2f76700152b3f86110d065a3e1ed1c0d
- SHA1 fc7f1da108846a6a7289bd7fb15ef868d45c0595
- SHA512 dea5f2468573ea19b2b6baf7029d2be1b43f8bd4151ebaeb5613f0ce3bfb476e22f581f14c062626440e3c42105b268d3d16f598168dcce1dc63a247d6a226bb
- TLSH T145900280681C251010B7210710241402A512A65494A106623D6C924017547645405241
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Pillow.ini
- Size 62B
- SHA256 f96256c1b1a8b90e70e289e328b702dad52ce6a6b474237b0ee7dc4e0dcf7c75
- MD5 9a3e73a4e50fc7675073b3ac26e8c9a3
- SHA1 608dd9139f4b8cc4e4b3be87c9d58542fa2cdaa1
- SHA512 bf6d5daff6309287bfe13a71ca096f6292e745693848e276cd0fc12fa99ab28a1a4d61a423963404c98e215252a87cf25b834499782c478b02c15a861aa356ed
- TLSH T16BA002545C651F1060D38E472464951A29A2210599528E277CDC9190439139598073A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp68F2.tmp\System.dll
- Size 25KB
- SHA256 29379ece432ccb81e22e57d7b5a8a77951c985495a931827f01771cf60b8b438
- MD5 9b3a5adad3c54468b976f683ef28aae4
- SHA1 e6ce3ed9fa51474ca560c41075be8cd52ae81e46
- SHA512 338ac47163f4c74af5c46318abf9d2a86febeeba4966ba2f3bcc5edc95ca373e253b3214fdcf349a13d431852b052d5910947ee9a63797ca4da0ba8333db4929
- SSDEEP 384:5Z2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHG1Q:5r96YIrx7lC7vU/kaG9uLmCdb
- TLSH T1A8B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp68F2.tmp\UserInfo.dll
- Size 7KB
- SHA256 e333cedc6a0c2c6aee171a7ed153b71a8fcc1b235664a2b38b0bed4f7a8be038
- MD5 3c662ed86938e5f318c331760c93c448
- SHA1 6c4dac8dc56e4750b340f04f2ec867dc081417ea
- SHA512 0f9f5a3f43b5b7da0791aa044e152200867d5e4070b312758680e266f83c567213828a402e33d34164b8beb4d9376d57d05ee67e031a140fa526426726c55fe6
- SSDEEP 96:USn/gFO2o+dVP9xwHs0VdKXSY7JeLn7vlH/4RQu7lH:rYJVP+3KXSdn799u
- TLSH T16BE1A78BB381696AC99AF6BC84FF2D2238777C301627161E980155663D346D2F735F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp68F2.tmp\nsDialogs.dll
- Size 14KB
- SHA256 e336c0f91eb419a3006c79683fe24bd6aaefb2e256153ef5b1525c723fc86f46
- MD5 71940cc9971044cfd95b6f83259281b4
- SHA1 249570d939797524713efefc93faa65b1ea8b297
- SHA512 d3f415bde982249bba11199c10517cbc6fc06d4dc607f256002d38aa41818576d4a51398078053a0f11d22e0cd3b0a280ec179221190a6f60464b004dd364eca
- SSDEEP 192:+ZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHWEdeqe4KFz0:YWh4MFv1w/YWCLXASKi6nAlHcAl4KW
- TLSH T18752191B7B42922ACD0AE374D5EF573322F3B4551138370E0669DB49BFE1660DA39288
- MD5 SHA1 SHA512 SSDEEP TLSH