Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 23:23
Behavioral task
behavioral1
Sample
8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe
- Size 640KB
- Sample260421-3ddfbshs7t
- SHA256 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e
- MD5 757b2c4b0f971efa92753d20b3f98717
- SHA1 5d82866c120243cb079e5810b276b8f29d762139
- SHA512 8a9eaf68c051fbaea258c08ce401a50e0d3aa846da2558d07372417ab19d28669807fee9c2c65eb98bc4c96bb590edd991baf87d319a4e2df7e8cfe5de4232d7
- SSDEEP 6144:+cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:+SvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T1F1D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4452 bda58660 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 41 223.5.5.5 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Destination IP 5 114.114.114.114 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Destination IP 6 223.5.5.5 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Destination IP 40 114.114.114.114 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bda58660 File created C:\Windows\SysWOW64\bda58660 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 bda58660 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bda58660 -
resource yara_rule behavioral1/memory/4288-0-0x0000000000370000-0x00000000003FC000-memory.dmp upx behavioral1/files/0x000a00000001f15c-2.dat upx behavioral1/memory/4452-3-0x0000000000370000-0x00000000003FC000-memory.dmp upx behavioral1/memory/4288-17-0x0000000000370000-0x00000000003FC000-memory.dmp upx behavioral1/memory/4452-18-0x0000000000370000-0x00000000003FC000-memory.dmp upx behavioral1/memory/4452-37-0x0000000000370000-0x00000000003FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4c3848 bda58660 File opened for modification C:\Windows\496980 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bda58660 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bda58660 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bda58660 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bda58660 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bda58660 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bda58660 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bda58660 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bda58660 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bda58660 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bda58660 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA bda58660 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 bda58660 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4452 bda58660 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Token: SeTcbPrivilege 4288 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Token: SeDebugPrivilege 4452 bda58660 Token: SeTcbPrivilege 4452 bda58660
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe"C:\Users\Admin\AppData\Local\Temp\8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
C:\Windows\Syswow64\bda58660C:\Windows\Syswow64\bda586601⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\bda58660
- Size 640KB
- SHA256 69a0ae9469deb753be6e0682697efb622ece670ff427e627c118e86434c782c9
- MD5 0418d60e71bb5a97065c08d1aa87de22
- SHA1 5806826f6d3a5d9fdb69e4681be21796753f1e12
- SHA512 77d398985b1eb385ee91b694e651c8b576b316bea8409c2897301156e31c404d97fb1dadfc2f53bf3b9fd8dabbbdc86704bf76447f70076e5cd442aae03cd18b
- SSDEEP 6144:HcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:HSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T1EED45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH