Analysis
- max time kernel
150s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 09:41
Behavioral task
behavioral1
Sample
f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe
- Size 1.4MB
- Sample260417-ln48csax4j
- SHA256 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478
- MD5 55a322a09d93037a1c54051064fc5617
- SHA1 3e044703b829c5f38c222ca5337490fbc3551a38
- SHA512 33c9d636ce0fa7e687256dc8c547f01815c55a9c04a359eb803a8b9eddd301b9ef4e5b306769c3c6f7afd7afba551234e18bf373837558b90cdf6c455b6de333
- SSDEEP 24576:OjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:OTGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T109658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4532 9f7e4c2c - Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 43 114.114.114.114 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Destination IP 45 223.5.5.5 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Destination IP 92 114.114.114.114 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Destination IP 93 223.5.5.5 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Destination IP 161 114.114.114.114 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Destination IP 162 223.5.5.5 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Destination IP 3 114.114.114.114 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Destination IP 10 223.5.5.5 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\9f7e4c2c f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9f7e4c2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9f7e4c2c -
resource yara_rule behavioral1/memory/4272-0-0x0000000001000000-0x0000000001089000-memory.dmp upx behavioral1/files/0x000b0000000243e7-2.dat upx behavioral1/memory/4532-3-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/4272-18-0x0000000001000000-0x0000000001089000-memory.dmp upx behavioral1/memory/4532-20-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/4532-22-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/4532-24-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/4272-35-0x0000000001000000-0x0000000001089000-memory.dmp upx behavioral1/memory/4532-36-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/4272-37-0x0000000001000000-0x0000000001089000-memory.dmp upx behavioral1/memory/4272-39-0x0000000001000000-0x0000000001089000-memory.dmp upx behavioral1/memory/4272-52-0x0000000001000000-0x0000000001089000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4d96e8 9f7e4c2c File opened for modification C:\Windows\492360 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9f7e4c2c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9f7e4c2c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9f7e4c2c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9f7e4c2c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9f7e4c2c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9f7e4c2c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9f7e4c2c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9f7e4c2c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9f7e4c2c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9f7e4c2c - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4532 9f7e4c2c 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Token: SeTcbPrivilege 4272 f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe Token: SeDebugPrivilege 4532 9f7e4c2c Token: SeTcbPrivilege 4532 9f7e4c2c
Processes
-
C:\Users\Admin\AppData\Local\Temp\f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe"C:\Users\Admin\AppData\Local\Temp\f849b8bde41b4b0e028762ed247fa0385d35d32655fc36f602b254c28024d478.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
C:\Windows\Syswow64\9f7e4c2cC:\Windows\Syswow64\9f7e4c2c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9f7e4c2c
- Size 1.4MB
- SHA256 541b04c9dd90e102e0b2be0921c57cf7b41411bde6750a4e4cc9a83e91a2b7b4
- MD5 23f891292ac3f60bd9c8f06be61ef240
- SHA1 9ea7b7b019db3856472afc8202999ec3c1e871f0
- SHA512 cc9c2d6673d7f22501925ab61bcaa902effb0d02eab1a75134f9c2567812db97b2c871dc948ba12b60badffd2bf44cf3f6965d307d43b92ff54087062b9c5260
- SSDEEP 24576:1jHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:1TGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T10B658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH