Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 23:27
Behavioral task
behavioral1
Sample
cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe
- Size 618KB
- Sample260415-3fpldaby7p
- SHA256 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df
- MD5 f85f79f1706108a5cb6a55124d94a318
- SHA1 34af10d17004a3bf42dc99c9c648aee8d99d1c91
- SHA512 3f911fa87f6b9c7e31ae9fe25e0e2dba9bab1672ceff36fe3e2179b66dbbe67adbae4d85d35af9e174638ae75a389529fff7737bd1077ffbd039f59951055337
- SSDEEP 12288:pqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:pjHPOSOkx2LFscUQPxW
- TLSH T1D6D47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3824 54b6a8be - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 30 223.5.5.5 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Destination IP 92 114.114.114.114 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Destination IP 93 223.5.5.5 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Destination IP 3 114.114.114.114 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Destination IP 4 223.5.5.5 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Destination IP 29 114.114.114.114 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 54b6a8be File created C:\Windows\SysWOW64\54b6a8be cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 54b6a8be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 54b6a8be -
resource yara_rule behavioral1/memory/4908-0-0x0000000000F10000-0x0000000000F99000-memory.dmp upx behavioral1/memory/3824-4-0x0000000000E80000-0x0000000000F09000-memory.dmp upx behavioral1/files/0x000900000002166e-3.dat upx behavioral1/memory/4908-20-0x0000000000F10000-0x0000000000F99000-memory.dmp upx behavioral1/memory/3824-23-0x0000000000E80000-0x0000000000F09000-memory.dmp upx behavioral1/memory/4908-38-0x0000000000F10000-0x0000000000F99000-memory.dmp upx behavioral1/memory/3824-39-0x0000000000E80000-0x0000000000F09000-memory.dmp upx behavioral1/memory/3824-41-0x0000000000E80000-0x0000000000F09000-memory.dmp upx behavioral1/memory/4908-42-0x0000000000F10000-0x0000000000F99000-memory.dmp upx behavioral1/memory/4908-47-0x0000000000F10000-0x0000000000F99000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4177e0 54b6a8be File opened for modification C:\Windows\5406d8 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54b6a8be - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 54b6a8be Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 54b6a8be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 54b6a8be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 54b6a8be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 54b6a8be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 54b6a8be Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 54b6a8be Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 54b6a8be Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 54b6a8be - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 3824 54b6a8be 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Token: SeTcbPrivilege 4908 cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe Token: SeDebugPrivilege 3824 54b6a8be Token: SeTcbPrivilege 3824 54b6a8be
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe"C:\Users\Admin\AppData\Local\Temp\cb719ac3af9380feab965d5cb842d2f650c06f15712237fe445b809076aaa3df.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Windows\Syswow64\54b6a8beC:\Windows\Syswow64\54b6a8be1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4177e0
- Size 506B
- SHA256 cd34a8278435deadb5c11352238803f631711bc5565f9b01b4e2469f43a596e7
- MD5 9312fc79f2ef1fd11b2e10ecf06a4671
- SHA1 f39b84f60d3cd520ce7b66b65dbd1cb5ec44b354
- SHA512 76c69e358271549fd5fa7783757a817dcc2d35e98a26ba9741f47905f4afefc373ea6d8f9b0eb9302a6cea00da2a987017a9c6b00bbea80d8a1b42a7cb7da171
- TLSH T1C0F0597EBD25E3EB0CE95DB29492A8450015A22F4233D189BEC23FC90DD12646ED7C0C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\54b6a8be
- Size 618KB
- SHA256 924cad0b7c1e6294b3ab381a1a2d24f34a90ba6b2c9ea4d967b1c58b3a0ab579
- MD5 09eb3e82c7c57cb8504c2cdb8777d3a8
- SHA1 c52d837be73072b3c420841f39320ef384783178
- SHA512 f48d68b0ec50f6b3c16d4bc198f81896d28dd945401d38a55c61a6ddbfb914eb796538d259e6e85d960d7e9971613b453ed179209696baa3b0d66795f39428fa
- SSDEEP 12288:YqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:YjHPOSOkx2LFscUQPxW
- TLSH T1ADD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH