Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 19:53
Behavioral task
behavioral1
Sample
87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe
- Size 832KB
- Sample260415-yl6pmaby21
- SHA256 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02
- MD5 2af8aee5792a8cd9b549be9a30d27b2a
- SHA1 26cb8fd55db4184ba33309dd7b6666c73c19c881
- SHA512 57169facbb856c85e1b67aaf654aa3c7ba307c778f4f73774ec1cbcec83967a616384063a7fec962004edca1eb4248e369d84ad5ee1c1b10921a2bfb2d9eb21f
- SSDEEP 12288:wqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:wjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T15E059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4264 b4987fc4 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 74 223.5.5.5 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 51 114.114.114.114 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 52 223.5.5.5 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 73 114.114.114.114 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 129 114.114.114.114 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 130 223.5.5.5 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 199 114.114.114.114 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 200 223.5.5.5 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 3 114.114.114.114 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 4 223.5.5.5 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b4987fc4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b4987fc4 File created C:\Windows\SysWOW64\b4987fc4 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b4987fc4 -
resource yara_rule behavioral1/memory/4364-0-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx behavioral1/files/0x000b0000000243e7-2.dat upx behavioral1/memory/4264-4-0x00000000001B0000-0x0000000000239000-memory.dmp upx behavioral1/memory/4364-20-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx behavioral1/memory/4264-22-0x00000000001B0000-0x0000000000239000-memory.dmp upx behavioral1/memory/4264-24-0x00000000001B0000-0x0000000000239000-memory.dmp upx behavioral1/memory/4364-39-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx behavioral1/memory/4264-40-0x00000000001B0000-0x0000000000239000-memory.dmp upx behavioral1/memory/4264-44-0x00000000001B0000-0x0000000000239000-memory.dmp upx behavioral1/memory/4364-46-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx behavioral1/memory/4364-57-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\490050 b4987fc4 File opened for modification C:\Windows\4ab698 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4987fc4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b4987fc4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b4987fc4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b4987fc4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b4987fc4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b4987fc4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b4987fc4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b4987fc4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b4987fc4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b4987fc4 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4264 b4987fc4 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Token: SeTcbPrivilege 4364 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Token: SeDebugPrivilege 4264 b4987fc4 Token: SeTcbPrivilege 4264 b4987fc4
Processes
-
C:\Users\Admin\AppData\Local\Temp\87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe"C:\Users\Admin\AppData\Local\Temp\87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
C:\Windows\Syswow64\b4987fc4C:\Windows\Syswow64\b4987fc41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b4987fc4
- Size 832KB
- SHA256 ffda9a1f134519ca1badcca732ae161867450f04cef51ecd268b47e8bbbb27c8
- MD5 23207f6f7322ccfa585fc6695210c200
- SHA1 6db15357434d9eaa2d4dfcd862821fc3e0e2b50d
- SHA512 b47c8fa9e935b03e856f793f9a2824e34ecb129175acfb6d2ee9151778dbe315d364af7c4d44328c44f42a4e189024d574cea41352ef93164aec62f7bb64e16b
- SSDEEP 12288:wqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:wjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T11B059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH