Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 03:49
General
- Target c47dde1fe89ac564d15d9de0520a1d978e5395f277195fe175270d8c2f22ca82.exe
- Size 2.6MB
- Sample260419-edd5vscs2q
- SHA256 c47dde1fe89ac564d15d9de0520a1d978e5395f277195fe175270d8c2f22ca82
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops file in System32 directory 17 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 9 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c47dde1fe89ac564d15d9de0520a1d978e5395f277195fe175270d8c2f22ca82.exe"C:\Users\Admin\AppData\Local\Temp\c47dde1fe89ac564d15d9de0520a1d978e5395f277195fe175270d8c2f22ca82.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Syswow64\52257aedC:\Windows\Syswow64\52257aed1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
52257aed
memory/4160-0-0x00000000006E0000-0x0000000000769000-memory.dmp
memory/4160-15-0x00000000006E0000-0x0000000000769000-memory.dmp
memory/4160-17-0x0000000001020000-0x0000000001027000-memory.dmp
memory/4160-37-0x00000000006E0000-0x0000000000769000-memory.dmp
memory/4160-58-0x00000000006E0000-0x0000000000769000-memory.dmp
memory/4160-66-0x00000000006E0000-0x0000000000769000-memory.dmp
memory/4796-4-0x0000000000DB0000-0x0000000000E39000-memory.dmp
memory/4796-18-0x0000000000DB0000-0x0000000000E39000-memory.dmp
memory/4796-19-0x0000000000720000-0x0000000000727000-memory.dmp
memory/4796-39-0x0000000000DB0000-0x0000000000E39000-memory.dmp
memory/4796-47-0x0000000000DB0000-0x0000000000E39000-memory.dmp