Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 08:34
Behavioral task
behavioral1
Sample
2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe
- Size 560KB
- Sample260415-kgf2hscy21
- SHA256 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a
- MD5 04eb9266079f2067fe27a67a5f50c6d4
- SHA1 54b7bfec1b90098b748a396f48914a1dc5c70829
- SHA512 068e7562a214196e1f0c8f1db7d581b9e5879eccb7a43853deab73034728251e65b3809248a5568c56489013340d9ff04e987b1153fd6d491f0870f88cfcdfec
- SSDEEP 6144:gWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:gkCO2zVPX7vf1LKlIsOkxHy
- TLSH T1F0C47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D40B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4704 a62bec16 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 30 223.5.5.5 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe Destination IP 2 114.114.114.114 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe Destination IP 3 223.5.5.5 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe Destination IP 28 114.114.114.114 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a62bec16 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C a62bec16 File created C:\Windows\SysWOW64\a62bec16 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a62bec16 -
resource yara_rule behavioral1/memory/4208-0-0x0000000000050000-0x00000000000DC000-memory.dmp upx behavioral1/files/0x00120000000241ea-2.dat upx behavioral1/memory/4704-3-0x0000000000B20000-0x0000000000BAC000-memory.dmp upx behavioral1/memory/4208-12-0x0000000000050000-0x00000000000DC000-memory.dmp upx behavioral1/memory/4704-13-0x0000000000B20000-0x0000000000BAC000-memory.dmp upx behavioral1/memory/4704-35-0x0000000000B20000-0x0000000000BAC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5088c0 a62bec16 File opened for modification C:\Windows\480ae0 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a62bec16 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a62bec16 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a62bec16 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a62bec16 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a62bec16 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a62bec16 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a62bec16 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a62bec16 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a62bec16 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a62bec16 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4704 a62bec16 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe Token: SeTcbPrivilege 4208 2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe Token: SeDebugPrivilege 4704 a62bec16 Token: SeTcbPrivilege 4704 a62bec16
Processes
-
C:\Users\Admin\AppData\Local\Temp\2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe"C:\Users\Admin\AppData\Local\Temp\2801c71c3511cd89694924486bd6b220ce0a3ed8771e1996fd4bfe26c000010a.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
C:\Windows\Syswow64\a62bec16C:\Windows\Syswow64\a62bec161⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a62bec16
- Size 560KB
- SHA256 b65f088eb594f4d75f09de66e5bcf7c6e591a16efbaa300655c7d0d07b8eaa67
- MD5 1e776f89446981fc5807e66ea19e63ab
- SHA1 da9bc71b144608c55d90c919f728532cd2ff2ba5
- SHA512 2a9b1ad38c0afd421d0cc46d93e3948d91826fafb52cdaa54e741c1d10583d091806e83c135c9dda290a3298b912ffd9fa2a3bc155ad632e310f1bdcc89c5eeb
- SSDEEP 6144:lWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:lkCO2zVPX7vf1LKlIsOkxHy
- TLSH T1CBC47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D00B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH