Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 19:53
Behavioral task
behavioral1
Sample
87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe
- Size 832KB
- Sample260415-yl6pmaby21
- SHA256 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02
- MD5 2af8aee5792a8cd9b549be9a30d27b2a
- SHA1 26cb8fd55db4184ba33309dd7b6666c73c19c881
- SHA512 57169facbb856c85e1b67aaf654aa3c7ba307c778f4f73774ec1cbcec83967a616384063a7fec962004edca1eb4248e369d84ad5ee1c1b10921a2bfb2d9eb21f
- SSDEEP 12288:wqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:wjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T15E059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4564 b34cc188 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 12 223.5.5.5 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 51 114.114.114.114 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 52 223.5.5.5 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 1 114.114.114.114 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 2 223.5.5.5 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Destination IP 11 114.114.114.114 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b34cc188 File created C:\Windows\SysWOW64\b34cc188 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b34cc188 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b34cc188 -
resource yara_rule behavioral2/memory/2084-0-0x0000000000840000-0x00000000008C9000-memory.dmp upx behavioral2/files/0x001d00000002b0f5-2.dat upx behavioral2/memory/4564-3-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/2084-25-0x0000000000840000-0x00000000008C9000-memory.dmp upx behavioral2/memory/2084-26-0x0000000000840000-0x00000000008C9000-memory.dmp upx behavioral2/memory/4564-28-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/4564-32-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/2084-37-0x0000000000840000-0x00000000008C9000-memory.dmp upx behavioral2/memory/4564-38-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/4564-40-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/2084-52-0x0000000000840000-0x00000000008C9000-memory.dmp upx behavioral2/memory/2084-57-0x0000000000840000-0x00000000008C9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4e2328 b34cc188 File opened for modification C:\Windows\23adc8 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b34cc188 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b34cc188 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b34cc188 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b34cc188 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b34cc188 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b34cc188 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b34cc188 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b34cc188 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b34cc188 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b34cc188 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 4564 b34cc188 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Token: SeTcbPrivilege 2084 87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe Token: SeDebugPrivilege 4564 b34cc188 Token: SeTcbPrivilege 4564 b34cc188
Processes
-
C:\Users\Admin\AppData\Local\Temp\87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe"C:\Users\Admin\AppData\Local\Temp\87a9e1bc6eb7393e6f4fe0eac0420eb0f4cc5cb55908969ed98594d9c4dc9f02.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
C:\Windows\Syswow64\b34cc188C:\Windows\Syswow64\b34cc1881⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4e2328
- Size 916B
- SHA256 7a8500475fca2ee1f2fc331ebc56835f378c0b0089b5b9c8f932753265e3fe79
- MD5 a26c7234b71d59060334aad23d0015a0
- SHA1 291ea1b890404c6a2e40bffe5d9647700b811924
- SHA512 85e3dca672424b959305af03ca67317efad58acf7acd64ca471cec7ead693d7ab25cefd0e0e7d0fec3c63e0364f06536963714a6261236c378524549b0e3f6a8
- TLSH T11D115C62A89C15F61DDDD62B9743AAC6F1E08335444D219C16D22A8127B39784F8252E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\b34cc188
- Size 832KB
- SHA256 dfb07f430b49df62bd71ac8f626a77b1b375ef9592a738a6be3429d185d141ab
- MD5 81e0bfc0b2401be4e1e29137b39e11cf
- SHA1 c25808772cc0277cfcad1a4d7f3d4f9399048340
- SHA512 876b2f6e9b650b8f54cb1d7b5b4e5de99579729bb17eb063638e122c88de04919930a9aaf74d4ffcfdd0acd2f0ee2946c307308f918bc34c8494283825cf6e1e
- SSDEEP 12288:DqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:DjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T199059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH