Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 09:47
Behavioral task
behavioral1
Sample
e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe
- Size 3.0MB
- Sample260415-lr8d7abs3j
- SHA256 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be
- MD5 af42b56f12c91103e5ee5b9763292336
- SHA1 25860804c1eeb4c32b34b2f13e35ba1af0cc0f9c
- SHA512 5a193c0c8fe6e657e0da45afc2c29daadf99021257ec8c952950aeb8df37d733c06ab23aafa8fcca75beb385b7e2415e689d16d9e81b6c314e687dafd648e723
- SSDEEP 49152:CA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:d/whnLrHp/qKm2/Sb/
- TLSH T156E55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1240 ec336143 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe Destination IP 2 223.5.5.5 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe Destination IP 17 114.114.114.114 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe Destination IP 18 223.5.5.5 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ec336143 File created C:\Windows\SysWOW64\ec336143 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ec336143 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C ec336143 -
resource yara_rule behavioral2/memory/3632-0-0x00000000008E0000-0x0000000000BE5000-memory.dmp upx behavioral2/files/0x0008000000000436-3.dat upx behavioral2/memory/1240-4-0x0000000000B40000-0x0000000000E45000-memory.dmp upx behavioral2/memory/3632-10-0x00000000008E0000-0x0000000000BE5000-memory.dmp upx behavioral2/memory/1240-12-0x0000000000B40000-0x0000000000E45000-memory.dmp upx behavioral2/memory/1240-30-0x0000000000B40000-0x0000000000E45000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec336143 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ec336143 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ec336143 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ec336143 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ec336143 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ec336143 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ec336143 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ec336143 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ec336143 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ec336143 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1240 ec336143 1240 ec336143 1240 ec336143 1240 ec336143 1240 ec336143 1240 ec336143 1240 ec336143 1240 ec336143 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe Token: SeTcbPrivilege 3632 e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe Token: SeDebugPrivilege 1240 ec336143 Token: SeTcbPrivilege 1240 ec336143
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe"C:\Users\Admin\AppData\Local\Temp\e5a123b00441a87b822c09a5e4a8f7908a38f1d1d23910c1f7651a11374773be.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
C:\Windows\Syswow64\ec336143C:\Windows\Syswow64\ec3361431⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ec336143
- Size 3.0MB
- SHA256 fc220424471fd5f08d01d165351cd5922aa33835231fd97127026f58c3fe74b7
- MD5 4bd716c8ba75a926661d77bd3fdf59e4
- SHA1 0e4e8248eda796295482209889e1a4381a0b928c
- SHA512 ac49787daaf3690950b60310c7d67fbf5c983b3de302fa45bfedc4707af5b8942ce28d1e5986a33b9b868cf0e967d015606195edba289513eeed97bb119edda8
- SSDEEP 49152:lA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:i/whnLrHp/qKm2/Sb/
- TLSH T133E55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH