Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 23:23
Behavioral task
behavioral1
Sample
8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe
- Size 640KB
- Sample260421-3ddfbshs7t
- SHA256 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e
- MD5 757b2c4b0f971efa92753d20b3f98717
- SHA1 5d82866c120243cb079e5810b276b8f29d762139
- SHA512 8a9eaf68c051fbaea258c08ce401a50e0d3aa846da2558d07372417ab19d28669807fee9c2c65eb98bc4c96bb590edd991baf87d319a4e2df7e8cfe5de4232d7
- SSDEEP 6144:+cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:+SvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T1F1D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4768 f0dbd374 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Destination IP 2 223.5.5.5 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Destination IP 6 114.114.114.114 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Destination IP 7 223.5.5.5 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\f0dbd374 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f0dbd374 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f0dbd374 -
resource yara_rule behavioral2/memory/4696-0-0x0000000000C10000-0x0000000000C9C000-memory.dmp upx behavioral2/files/0x00130000000256dc-2.dat upx behavioral2/memory/4768-4-0x0000000000900000-0x000000000098C000-memory.dmp upx behavioral2/memory/4696-10-0x0000000000C10000-0x0000000000C9C000-memory.dmp upx behavioral2/memory/4768-12-0x0000000000900000-0x000000000098C000-memory.dmp upx behavioral2/memory/4768-42-0x0000000000900000-0x000000000098C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\51a140 f0dbd374 File opened for modification C:\Windows\5065b0 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0dbd374 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f0dbd374 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f0dbd374 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f0dbd374 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f0dbd374 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f0dbd374 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f0dbd374 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f0dbd374 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f0dbd374 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f0dbd374 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4768 f0dbd374 4768 f0dbd374 4768 f0dbd374 4768 f0dbd374 4768 f0dbd374 4768 f0dbd374 4768 f0dbd374 4768 f0dbd374 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Token: SeTcbPrivilege 4696 8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe Token: SeDebugPrivilege 4768 f0dbd374 Token: SeTcbPrivilege 4768 f0dbd374
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe"C:\Users\Admin\AppData\Local\Temp\8a499eb51fb7b0d87a2ce454bc7a5cd0b2efc2c967fa18296a3975d8a170557e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
C:\Windows\Syswow64\f0dbd374C:\Windows\Syswow64\f0dbd3741⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\f0dbd374
- Size 640KB
- SHA256 da7f13bc907c38137a6f93e894487f2f30aae122a158e4f80cf95ce2352fc7ca
- MD5 31a01970a5815ef81bc93e87395ddc58
- SHA1 bebe65d82000605f406c9870f500bd629f0b75c6
- SHA512 7c88652ccb0b164b78b3c03e4a8c80d05774df9e8ccecb233cd4c0f1bc7e1b89d7261c634aaed4434193b18e87ceaca3eaca0c80d9c16ebadd032d771fb8658e
- SSDEEP 6144:IcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:ISvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T19CD45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH