Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe
- Size 960KB
- Sample260422-2drghsc191
- SHA256 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa
- MD5 3ef1bae540773b4b1af3e8fcbd85a929
- SHA1 3ae7ea0130b491723e19651f0b664ff173d7e43b
- SHA512 14948364aa3829bb5492e0fead3399c7813ec5053aa0feb25040636664950a9755f8d1b39a32fcea2e961bf4ae7fa6b285a91bbda8eab930986733a8431843f0
- SSDEEP 24576:kvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OQ:kHHKO29QG5QZuT2
- TLSH T1E3257C31E641C03AD4A741B686BA4BBFA4787D25031565C7E3D43E6A2FB22D27E3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3192 383d5294 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe Destination IP 6 223.5.5.5 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe Destination IP 36 114.114.114.114 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe Destination IP 39 223.5.5.5 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 383d5294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 383d5294 File created C:\Windows\SysWOW64\383d5294 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\36a5f0 383d5294 File opened for modification C:\Windows\1164f0 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 383d5294 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 383d5294 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 383d5294 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 383d5294 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 383d5294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 383d5294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 383d5294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 383d5294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 383d5294 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 383d5294 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 3192 383d5294 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe Token: SeTcbPrivilege 1016 08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe Token: SeDebugPrivilege 3192 383d5294 Token: SeTcbPrivilege 3192 383d5294
Processes
-
C:\Users\Admin\AppData\Local\Temp\08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe"C:\Users\Admin\AppData\Local\Temp\08c48dbd99fc45b41ce68364202a0a7995316c16fd9aac2945c4c0e5bee7e5fa.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
C:\Windows\Syswow64\383d5294C:\Windows\Syswow64\383d52941⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\36a5f0
- Size 506B
- SHA256 b2e520dfc514067a079c822fb0a018f039138daace2930969b4c28fc87dd5b84
- MD5 0f33515b070326486cd18ccd78d771ef
- SHA1 e1f8d5a07b4f115ba84c31a911592bd144cd09c1
- SHA512 c43022ba309d10a983cbb4aba7f72160fcac4f8634cc87979a538f505585555337bd97877df5a9649c09f54b6fc3d0a00cd1fddb7751bedf6c53419561c09a1f
- TLSH T1E3F00EBFE43EEE60C9AAACA1787FF85F501D723DC02B92551DE0BCC00591255AB87C48
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\383d5294
- Size 960KB
- SHA256 55f019d7734f1d8fce18cc30fad1c9dab2e2a794a07c1f5a4dcc0334bdaf1261
- MD5 8d9c0e84cb66e98ff2c53b6227085d4f
- SHA1 2be336c1e38ae7e5b4e861790557a2e20a57be9d
- SHA512 9bced6b4c53b0c3b50a605c2768cbede708e4f6f63533ce37de496bb1af575a9e7d70b522d5f3e2a2817f4d2c67f29caa1374c2427c121eed95b622b09dd0c45
- SSDEEP 24576:OvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OQ:OHHKO29QG5QZuT2
- TLSH T19A257C31E641C03AD4A741B686BA4BBFA4787D25031565C7E3D43E6A2FB22D27E3170E
- MD5 SHA1 SHA512 SSDEEP TLSH