3400a7df9ec3dc8283d5ac7accb6935691e93feda066cc46c6c04d67f7f87b2b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/02/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capa-testfiles-master/0796f1c1ea0a142fc1eb7109a44c86cb.exe
Size 44KB
Sample260218-p7apmses6f
SHA256 3400a7df9ec3dc8283d5ac7accb6935691e93feda066cc46c6c04d67f7f87b2b
MD5 0796f1c1ea0a142fc1eb7109a44c86cb
SHA1 335743acfd91055a2c98ef0400a3c414464aa004
SHA512 70512b01975a393e21f94f99fa17e2c4df13732bd53591d9c9f4a9160a04ba524736684e0c4ab181c9c93c542da4e1d2306968af98d9f645402382c7f96c850c
SSDEEP 768:PfFe0W7ohwU17d2yro3+1bex7KcDhIlOlftsuiJ7G7Nm3SvXpXe4q:Pt47oSq7dT71beBKIYKVsuRNX
TLSH
T1B0237C42BE95F832CA2201F2693AE996DA7B65301B4475F7FB40DC482C796D0EC3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Tries to connect to .bazar domain 64 IoCs

Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

flow	ioc
165	portgame.bazar
51	portgame.bazar
76	portgame.bazar
83	portgame.bazar
135	portgame.bazar
153	portgame.bazar
59	portgame.bazar
102	portgame.bazar
125	portgame.bazar
136	portgame.bazar
24	portgame.bazar
63	portgame.bazar
116	portgame.bazar
131	portgame.bazar
143	portgame.bazar
163	portgame.bazar
20	portgame.bazar
46	portgame.bazar
98	portgame.bazar
117	portgame.bazar
132	portgame.bazar
164	portgame.bazar
30	portgame.bazar
61	portgame.bazar
84	portgame.bazar
150	portgame.bazar
96	portgame.bazar
115	portgame.bazar
119	portgame.bazar
133	portgame.bazar
68	portgame.bazar
69	portgame.bazar
70	portgame.bazar
21	portgame.bazar
41	portgame.bazar
44	portgame.bazar
129	portgame.bazar
134	portgame.bazar
138	portgame.bazar
28	portgame.bazar
31	portgame.bazar
140	portgame.bazar
58	portgame.bazar
100	portgame.bazar
151	portgame.bazar
22	portgame.bazar
77	portgame.bazar
120	portgame.bazar
147	portgame.bazar
149	portgame.bazar
34	portgame.bazar
126	portgame.bazar
32	portgame.bazar
110	portgame.bazar
142	portgame.bazar
73	portgame.bazar
74	portgame.bazar
114	portgame.bazar
130	portgame.bazar
75	portgame.bazar
27	portgame.bazar
29	portgame.bazar
42	portgame.bazar
54	portgame.bazar

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	38	81.2.241.148	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	69	89.18.27.167	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	73	176.126.70.119	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	81	45.32.160.206	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	98	87.98.175.85	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	149	185.117.154.144	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	103	111.67.20.8	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	104	163.53.248.170	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	116	51.254.25.115	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	118	50.3.82.215	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	135	104.238.186.189	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	152	217.12.210.54	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	153	185.164.136.225	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	166	69.164.196.21	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	65	185.208.208.141	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	102	5.132.191.104	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	148	91.217.137.37	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	161	172.98.193.42	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	97	91.217.137.37	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	145	89.35.39.64	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	143	82.196.9.45	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	164	167.99.153.82	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	49	163.172.185.51	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	78	63.231.92.27	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	112	158.69.160.164	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	114	31.171.251.118	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	132	92.222.97.145	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	138	94.177.171.127	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	22	91.217.137.37	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	28	111.67.20.8	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	32	158.69.239.167	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	75	217.12.210.54	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	85	162.248.241.94	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	89	69.164.196.21	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	108	142.4.205.47	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	125	45.71.112.70	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	27	5.132.191.104	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	39	51.254.25.115	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	46	139.59.208.246	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	129	51.255.48.78	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	127	87.98.175.85	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	146	89.18.27.167	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	155	63.231.92.27	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	158	45.32.160.206	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	21	193.183.98.66	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	76	185.164.136.225	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	139	45.63.124.65	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	30	142.4.204.111	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	35	158.69.160.164	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	86	107.172.42.186	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	121	130.255.78.223	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	133	51.255.211.146	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	23	87.98.175.85	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	57	159.89.249.249	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	63	212.24.98.54	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	77	192.52.166.110	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	115	81.2.241.148	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	124	172.104.136.243	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	130	188.165.200.156	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	134	159.89.249.249	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	55	92.222.97.145	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	60	193.183.98.66	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	100	169.239.202.202	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe
Destination IP	123	139.59.208.246	4336	0796f1c1ea0a142fc1eb7109a44c86cb.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0796f1c1ea0a142fc1eb7109a44c86cb.exe

C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0796f1c1ea0a142fc1eb7109a44c86cb.exe
"C:\Users\Admin\AppData\Local\Temp\capa-testfiles-master\0796f1c1ea0a142fc1eb7109a44c86cb.exe"
1⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads