Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 10:06
Behavioral task
behavioral1
Sample
9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe
- Size 766KB
- Sample260416-l47nesfx2w
- SHA256 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab
- MD5 4804347a9bf7f63a3e3a4cb9592cf987
- SHA1 4c0e60b5f67f989fede717f35f1f924c07e4244c
- SHA512 28bb69f62cdeb5da9d0fd609a1b8f0b45f369869d33fbb101de93b328e35710746a8dd4509475bf049e3867d1424884eec0f0ce28792c38d348ab6673c023506
- SSDEEP 12288:RSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:4vO2xJKRw2kOkx2LFRvcUV
- TLSH T1B5F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4736 8d6597b7 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 22 223.5.5.5 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe Destination IP 3 114.114.114.114 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe Destination IP 4 223.5.5.5 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe Destination IP 20 114.114.114.114 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8d6597b7 File created C:\Windows\SysWOW64\8d6597b7 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8d6597b7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8d6597b7 -
resource yara_rule behavioral1/memory/4640-0-0x0000000000240000-0x00000000002CC000-memory.dmp upx behavioral1/files/0x000a00000001f15c-2.dat upx behavioral1/memory/4736-3-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral1/memory/4640-20-0x0000000000240000-0x00000000002CC000-memory.dmp upx behavioral1/memory/4736-22-0x0000000000630000-0x00000000006BC000-memory.dmp upx behavioral1/memory/4736-42-0x0000000000630000-0x00000000006BC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\511500 8d6597b7 File opened for modification C:\Windows\4f7040 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d6597b7 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8d6597b7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8d6597b7 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8d6597b7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8d6597b7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8d6597b7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8d6597b7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8d6597b7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8d6597b7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8d6597b7 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4736 8d6597b7 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe Token: SeTcbPrivilege 4640 9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe Token: SeDebugPrivilege 4736 8d6597b7 Token: SeTcbPrivilege 4736 8d6597b7
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe"C:\Users\Admin\AppData\Local\Temp\9fdd4ef8d56f6df320592c910cf989bf460886ad51374ddfd860921cd24081ab.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
C:\Windows\Syswow64\8d6597b7C:\Windows\Syswow64\8d6597b71⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\8d6597b7
- Size 766KB
- SHA256 03a47119da8732fbcd3a58a659134a3191a053d941df2038a0e4b76f5026b61d
- MD5 1e2716f6b9c63c28bc5d70894f606e57
- SHA1 447a8fad5647385be7bd75548ff42ca020df77b0
- SHA512 33e33d9fdff2dc07483ecb583906e914f17a5ac78f146fbf4ddf2c4bd9b606b772b46fe1c57e0bb88d656183a734cd28b8e69d65b296cad49c2c09e1ad8c340e
- SSDEEP 12288:YSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:zvO2xJKRw2kOkx2LFRvcUV
- TLSH T156F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH