Analysis
- max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 23:21
Behavioral task
behavioral1
Sample
c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe
- Size 761KB
- Sample260420-3chcwsft7q
- SHA256 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b
- MD5 51327598a83baba29222ed47ef67562e
- SHA1 d4cd7faec72dd6400abc91df79987faa1ea79c29
- SHA512 f5f260a5927e2638b546f274c1d09303ba297e1c15b4332562684caec90fb8694d9ed6cfd3ee08d026e4af4da1250b3b2b5cde63270091d18f398a437448cc1f
- SSDEEP 12288:bSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:uvO2xJKRw2kOkxSkW298B
- TLSH T15BF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5096 968e7a6b - Unexpected DNS network traffic destination 12 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 36 223.5.5.5 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 57 114.114.114.114 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 58 223.5.5.5 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 119 223.5.5.5 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 186 114.114.114.114 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 1 114.114.114.114 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 2 223.5.5.5 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 35 114.114.114.114 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 117 114.114.114.114 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 127 114.114.114.114 5096 968e7a6b Destination IP 133 223.5.5.5 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Destination IP 187 223.5.5.5 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 968e7a6b File created C:\Windows\SysWOW64\968e7a6b c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 968e7a6b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 968e7a6b -
resource yara_rule behavioral2/memory/8-0-0x00000000002B0000-0x000000000033C000-memory.dmp upx behavioral2/files/0x0010000000027002-2.dat upx behavioral2/memory/5096-3-0x0000000000330000-0x00000000003BC000-memory.dmp upx behavioral2/memory/8-18-0x00000000002B0000-0x000000000033C000-memory.dmp upx behavioral2/memory/5096-19-0x0000000000330000-0x00000000003BC000-memory.dmp upx behavioral2/memory/5096-36-0x0000000000330000-0x00000000003BC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\573ed0 968e7a6b File opened for modification C:\Windows\2310 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 968e7a6b - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 968e7a6b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 968e7a6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 968e7a6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 968e7a6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 968e7a6b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 968e7a6b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 968e7a6b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 968e7a6b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 968e7a6b - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5096 968e7a6b 5096 968e7a6b 5096 968e7a6b 5096 968e7a6b 5096 968e7a6b 5096 968e7a6b 5096 968e7a6b 5096 968e7a6b 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Token: SeTcbPrivilege 8 c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe Token: SeDebugPrivilege 5096 968e7a6b Token: SeTcbPrivilege 5096 968e7a6b
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe"C:\Users\Admin\AppData\Local\Temp\c2b9e72cbcefcf3ee5a902b189a54e5afdd2d4fae01d7980413f532aa3dadb1b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
C:\Windows\Syswow64\968e7a6bC:\Windows\Syswow64\968e7a6b1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\968e7a6b
- Size 761KB
- SHA256 138f87198316f1d5782c27014a6f473517206a70cde251ad246392d2c1818b1d
- MD5 84e5f9aabf6332b64d787575555644fb
- SHA1 8f8978fa60c98a2e33a2a4c321a1942642d607ce
- SHA512 d96068623d7382984e2e7540833ef109e3a3c2bfd9df76c14d411ce7e34070eec7df4dfa14cc02ecb79c5d52154921cf07b0ecfd48f0132e3334263f5ba727bb
- SSDEEP 12288:TSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:mvO2xJKRw2kOkxSkW298B
- TLSH T11CF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH