Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 10:22
Behavioral task
behavioral1
Sample
ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe
- Size 832KB
- Sample260416-melv4acy2m
- SHA256 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb
- MD5 540edb0c419c5a98f4a39cd28ddd9d83
- SHA1 ee6d0c041823f9a63df87ff77008284a451c4565
- SHA512 c8e960feaba0389269e62b4da5ff2a82b3f3715c0cea3bf452bf85027dd186dc313ec07fa89fb978408d453ec2a51ab69e6f7038016beda084673a8b01497cca
- SSDEEP 12288:rqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:rjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T128059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2776 1742f342 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 20 223.5.5.5 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe Destination IP 1 114.114.114.114 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe Destination IP 2 223.5.5.5 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe Destination IP 19 114.114.114.114 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1742f342 File created C:\Windows\SysWOW64\1742f342 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1742f342 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1742f342 -
resource yara_rule behavioral2/memory/3852-0-0x0000000000730000-0x00000000007B9000-memory.dmp upx behavioral2/memory/2776-4-0x00000000008C0000-0x0000000000949000-memory.dmp upx behavioral2/files/0x002100000002b19d-3.dat upx behavioral2/memory/3852-18-0x0000000000730000-0x00000000007B9000-memory.dmp upx behavioral2/memory/2776-20-0x00000000008C0000-0x0000000000949000-memory.dmp upx behavioral2/memory/2776-24-0x00000000008C0000-0x0000000000949000-memory.dmp upx behavioral2/memory/3852-35-0x0000000000730000-0x00000000007B9000-memory.dmp upx behavioral2/memory/2776-36-0x00000000008C0000-0x0000000000949000-memory.dmp upx behavioral2/memory/3852-43-0x0000000000730000-0x00000000007B9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2f86b0 1742f342 File opened for modification C:\Windows\41f298 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1742f342 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1742f342 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1742f342 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1742f342 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1742f342 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1742f342 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1742f342 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1742f342 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1742f342 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1742f342 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2776 1742f342 2776 1742f342 2776 1742f342 2776 1742f342 2776 1742f342 2776 1742f342 2776 1742f342 2776 1742f342 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe Token: SeTcbPrivilege 3852 ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe Token: SeDebugPrivilege 2776 1742f342 Token: SeTcbPrivilege 2776 1742f342
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe"C:\Users\Admin\AppData\Local\Temp\ce52ea1f3a3695844983eb81115150eddd49bacc525bb405947ac190d36fb9fb.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
C:\Windows\Syswow64\1742f342C:\Windows\Syswow64\1742f3421⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1742f342
- Size 832KB
- SHA256 9d729fcfe9aa19de78b3607ecb743210c1aff1a2537297a9485ee9f0cf0728c4
- MD5 b7b56233660320968ac508a9645d8f22
- SHA1 d6c13b78bea803ae5ac5a5ee08c6ed45429bfdaf
- SHA512 f334bbdfe3d33e6a302b945a959497d5ffabd30aedd354ec1fc524a94e56bba7c95424519880001fb8b5750292213afea6489d2aae44209638764d69e7a6455c
- SSDEEP 12288:XqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:XjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T1CA059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH