Analysis
- user interaction
yes - max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FirstandThirdmerged64 2017.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target FirstandThirdmerged64 2017.exe
- Size 11.6MB
- Sample260415-yaplzag16r
- SHA256 66ceca16b8cc8679e3fc136b65e28a28b039f6e64cb0dff58a0593dad03d161c
- MD5 9334a7ecba10c50cc2517a0f668f867f
- SHA1 555bbfa635d95dc1c71c785bae9527612ec0261e
- SHA512 76cefd1069c14875d5aefd0b3368565005405570fbace29f2c643196f2275668a59f2e3385925ef819c4651440832e391b82187ce3c8b8fe2aa0aaf7465af180
- SSDEEP 98304:P/7zk1jAQ3b2+69FNOuIRLef4hX0ocotRPlIQTFc17xwgEpoSE5uWBprXv:PwAo2+69FNOuIRLef4hEaRPlIQmRT
- TLSH T19EC62CBB7192CAD9C0CAC27558C7CBF15A31BD1409B1164732D5331FAFBA8901E9A98F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4776 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe - Loads dropped DLL 1 IoCs
pid Process 4056 FirstandThirdmerged64 2017.exe - Drops file in System32 directory 42 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM32\wsock32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\clbcatq.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\version.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\hhctrl.ocx FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\shell32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\combase.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\win32u.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\msvcrt.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\KERNEL32.DLL FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\ole32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\GDI32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\gdi32full.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\KERNELBASE.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\oleaut32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\msvcp_win.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\ucrtbase.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\shcore.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\system32\uxtheme.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\wininet.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\sechost.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\system32\shfolder.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\MSCTF.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\RPCRT4.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\imagehlp.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\imm32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\kernel.appcore.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\comdlg32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\advapi32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\system32\explorerframe.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\Wldp.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\profapi.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\SHLWAPI.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\ws2_32.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\psapi.dll FirstandThirdmerged64 2017.exe File opened for modification C:\Windows\System32\user32.dll FirstandThirdmerged64 2017.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll FirstandThirdmerged64 2017.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FirstandThirdmerged64 2017.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FirstandThirdmerged64 2017.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeTcbPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeTcbPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeLoadDriverPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeCreateGlobalPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeLockMemoryPrivilege 4056 FirstandThirdmerged64 2017.exe Token: 33 4056 FirstandThirdmerged64 2017.exe Token: SeSecurityPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeTakeOwnershipPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeManageVolumePrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeBackupPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeCreatePagefilePrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeShutdownPrivilege 4056 FirstandThirdmerged64 2017.exe Token: SeRestorePrivilege 4056 FirstandThirdmerged64 2017.exe Token: 33 4056 FirstandThirdmerged64 2017.exe Token: SeIncBasePriorityPrivilege 4056 FirstandThirdmerged64 2017.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4056 FirstandThirdmerged64 2017.exe 4056 FirstandThirdmerged64 2017.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4448 wrote to memory of 4776 4448 FirstandThirdmerged64 2017.exe 86 PID 4776 wrote to memory of 4056 4776 FirstandThirdmerged64 2017.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\FirstandThirdmerged64 2017.exe"C:\Users\Admin\AppData\Local\Temp\FirstandThirdmerged64 2017.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\FirstandThirdmerged64 2017.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\FirstandThirdmerged64 2017.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\extracted\FirstandThirdmerged64 2017.exe"C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\extracted\FirstandThirdmerged64 2017.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4056
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\CET_Archive.dat
- Size 11.4MB
- SHA256 31381518c574d266efc9ddb17b197f5d251eeee762e95c4abec2e9235bf534e4
- MD5 87c67a7608e23c721dc2aae01e84e196
- SHA1 33d67ef7f5ce9bcb220bd76301022e594c309eb7
- SHA512 833372ae2f6556d4a7337b49c3751ef15ee2a5d55a4bdadc712b4fa8a2fbf335da1267b07ce64fdd2bbf9e89a9c6e2051135fa03bfca406fde0b2328437da7ff
- SSDEEP 98304:d/7zk1jAQ3b2+69FNOuIRLef4hX0ocotRPlIQTFc17xwgEpoSE5uWBprX:dwAo2+69FNOuIRLef4hEaRPlIQmR
- TLSH T1E7C62CBB71A1CED9C0CAC27558C7CAF15A31BD1409B1164732D5331FAFBA8901E9A98F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\FirstandThirdmerged64 2017.exe
- Size 189KB
- SHA256 dab3003436b6861ae220cc5fdcb97970fc05afdf114c2f91e46eed627ce3d6af
- MD5 a65c29111a4cf5a7fdd5a9d79f77bcab
- SHA1 c0c59b1f792c975558c33a3b7cf0d94adc636660
- SHA512 b37ef3351e8f46f7183550254acce99b54e0199fc37a02cca78b471dc2d8b697769afdaf7e6cfe89422cfed65a8dcc6d158ef52aba5b0ac9350ea05607fefd7f
- SSDEEP 3072:/bpNXPzitxNyVg64pEIP9lz3mjoOejfyyswe710LJNEXvXO29s6l8Bji1u78xb/1:/1NXPQNyVg64p5P9lz33OezRswe710Ll
- TLSH T1C4144C95E742833BC4437EF54B8985F65A70EB242D31C0EB32D90B0EDBB5EA06E35256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\extracted\CET_TRAINER.CETRAINER
- Size 3KB
- SHA256 909d664fd0d26de85c3cf963b1025288579b12d3a1de797fda3f7262fd031a2c
- MD5 3d8def212aa939c5b529e19c6ace31a7
- SHA1 b942f1f3b40af3b27b394212a14b8e286c381a47
- SHA512 cd04a583d89f89fbecf21a74e4548695d62c058846ff6b8f5607487476078e161fb9745e794b378dd967de162720b670556005ec90918d65d19f5ac80a75e068
- TLSH T14B717E1665835DF204AFB5151C779D31FDFC9B0410562EDCC6D675A5806C57868CE143
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\extracted\FirstandThirdmerged64 2017.exe
- Size 10.9MB
- SHA256 39fd24b30ffe5a884a4bfcdc4e240ee0e56b11bea9d19d7b590d0e6541fc8963
- MD5 b0aa1068b4a2a562b4d9796400d4e29f
- SHA1 e854cc14c72c4106af6ba13eb1c0eb3b74873e32
- SHA512 1b06eea09535835637e5db16c6ad8003b17303c7b4288db9b69d8e8c839253c9c5c8b3767b2f18dd4cf13936b1f70b457758d73d4bd0d3d74393c64f02089b22
- SSDEEP 98304:g/BzkHD0Q/T2+69FNOuIRVul6td0os2DNxN6Y7fuzjLIgEnoSE5D:ga0Q2+69FNOuIRVul6t6WNxN6Yanb
- TLSH T107B61BBB7192CED9C0CAC27658C6CAF15A31BD1409B1164732D5331FEFBA8501E9A98F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\extracted\defines.lua
- Size 6KB
- SHA256 54dbd22ed951515db3d92d948cfd8f590526220dc3231f56f3d1dda7005c72e8
- MD5 1197da76333f56519b3424cef6c2fe8c
- SHA1 59f2fb8cc88e33a958589d9733464e72fbc50c6e
- SHA512 5051763eff99926a032570a43e6240079600a0c72029bf20421553e75b8da723b7da50799e33368c148ccb46a994e46fa5db242663497e6acaceb8acd410ecb2
- SSDEEP 192:0egHuderGTd4G9mSKk/8fdtINfbLmiFcSC5xm+9ch07m:AHuderlSKk/8FtIF7umMcn
- TLSH T124D1095A1907120F027227AF6ED941814AC4EE3C84A0A933B35F1C7D7E9A469DBE13BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cetrainers\CET74E.tmp\extracted\lua53-64.dll
- Size 508KB
- SHA256 a07d73aaa2335957dcfb6850a35417e1753a14ff0f4cc1422c697e164163c861
- MD5 31817fdc8268c9b2753bc38b07e0a52c
- SHA1 ec4b0d4accafc43339be79dbec73df509f58434b
- SHA512 7f6adfc35e83889c7996b6332b3b3669cb955dd6047bf9a7f49e8e897d21acf79586f5ce0a0e8bd623a75a12563331f841110f2e0b4259a2725853c5ba32ac26
- SSDEEP 12288:UCsVtWwEWBpr/H4YXUrGX7q2Bs7KhkI4obN:sXW3WBprwEUrk7qqW8
- TLSH T1E5B47B6D6A640AB9D973D039CA634247D2F1385903B09BEF82E457B12F33BE02677725
- MD5 SHA1 SHA512 SSDEEP TLSH