Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system - submitted
21/11/2025, 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe
- Size 220KB
- Sample251121-mgqbaseq4w
- SHA256 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee
- MD5 63857018db54fcb41ae9f3155270eba4
- SHA1 3e776e9ba47a6252368ce8a2efa2072fa4aa1014
- SHA512 58c1f6e4ffdb9c329b0183bc3ff3ac348f075dad1dec65bacead544a25f81bb4c4fa7da69155de7381cae7e97c7d5d9ea6440b2c491eb42a8b9013b6c5a186d8
- SSDEEP 3072:TFY3/I0CWXmLXCnNgP6AB914CO5z09G4vThUDj1iu+qwELbYmTdWe6NFxWmRyQ5R:BY3/vGyABv4CFEDwELbYmdM8QL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Dorkbot worm 5 IoCs
resource yara_rule behavioral1/memory/3608-2-0x0000000000400000-0x000000000044E000-memory.dmp family_dorkbot behavioral1/memory/3608-4-0x0000000000400000-0x000000000044E000-memory.dmp family_dorkbot behavioral1/memory/3608-5-0x0000000000400000-0x000000000044E000-memory.dmp family_dorkbot behavioral1/memory/3608-6-0x00000000022A0000-0x00000000022EE000-memory.dmp family_dorkbot behavioral1/memory/3608-8-0x0000000000400000-0x000000000044E000-memory.dmp family_dorkbot - Dorkbot family
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3400 set thread context of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8F3D4209-C6C4-11F0-B7EA-DA9FB4A9548E} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1675626579" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31218385" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "470485771" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1673282689" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31218385" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe Token: SeDebugPrivilege 5340 IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 212 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 212 IEXPLORE.EXE 212 IEXPLORE.EXE 5340 IEXPLORE.EXE 5340 IEXPLORE.EXE 5340 IEXPLORE.EXE 5340 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3400 wrote to memory of 3608 3400 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 85 PID 3608 wrote to memory of 204 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 90 PID 3608 wrote to memory of 204 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 90 PID 3608 wrote to memory of 204 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 90 PID 204 wrote to memory of 212 204 iexplore.exe 91 PID 204 wrote to memory of 212 204 iexplore.exe 91 PID 212 wrote to memory of 5340 212 IEXPLORE.EXE 92 PID 212 wrote to memory of 5340 212 IEXPLORE.EXE 92 PID 212 wrote to memory of 5340 212 IEXPLORE.EXE 92 PID 3608 wrote to memory of 5340 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 92 PID 3608 wrote to memory of 5340 3608 01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe"C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe"C:\Users\Admin\AppData\Local\Temp\01ab30c83d4412b957a35eb67b6ab35be3e32e1568b58646e6075f026e5041ee.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:212 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5340
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
- Size 471B
- SHA256 04308166f7fac3c483b67e19c60d707b2d204c2367e73b8f901c5c21fe58f8af
- MD5 57083bbd8717e2d1652f8a256f01879d
- SHA1 4849334f0f98fdfa26c2c6c30467bc69e8804f0e
- SHA512 8b6b82aeae8d9e972bb2b34cb9cb37a46ac9bcf48ca22885d133abc682bb7f4460fe36d99d63aa7c8bd707ae7f29702702bb5d32c9c464c289a3acfdf0c1989a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0
- Size 400B
- SHA256 90f0fb0d2907afafd3b173fbbd4982407e9d2bb768987cb7f8edae393f0450ee
- MD5 90cc50a8e586261a898991af89db7eff
- SHA1 9de7e2bcd8c966fb62e091f2b930734941d7f0c8
- SHA512 29167f4a0f6e0207256e7603b9e0d3e88a5388049aac2ee989f19c559bae2c09e5f8e18035407e5ce763014c62b4f4d519c60ffe4d71ce77fc5ed0383e0fef36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OKNDLG0X\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP