72f4d3e137db5ae8cde66c1b8d000488f16e2ab27a761fe287647010034887cd

Analysis

max time kernel
598s
max time network
474s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/11/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IdleOS/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
Size 52B
Sample261110-ramdaaax2l
SHA256 72f4d3e137db5ae8cde66c1b8d000488f16e2ab27a761fe287647010034887cd
MD5 e2e460fae8682d83a0f080dc3fc6ea99
SHA1 1f3347c00b7a83709406e7f67659741fffecc48e
SHA512 a741b7f3c34b46206a6146c34bd01fb71b06de856dc1271ddf13a19e9e1adc85e23aaf3cf690fa17dace117b7db25167916d38383fb50bab1b0ea5bebe81fc03
TLSH
T1EA900256451AD0599316084C851195579842219949AAC464D241DB1C588B15485A4708
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Uses Rundll32 to proxy-execute a payload 1 TTPs 1 IoCs

Rundll32 is a signed Windows utility that executes code inside DLLs. It can load specific system libraries to run malicious executables or scripts.

defense_evasion

Rundll32

T1218.011

pid	Process
6092	rundll32.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\IdleOS\STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url"
1⤵
- Uses Rundll32 to proxy-execute a payload
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads