Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 22:28
Behavioral task
behavioral1
Sample
08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe
- Size 576KB
- Sample260422-2dwfgads2v
- SHA256 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1
- MD5 bf131b38b0ebc3603479e40294a45e08
- SHA1 32208202c8ed26a45503d813ec8e177730380c73
- SHA512 75a8c1ab1a5abbfb2a587efa06a6d0f3c51d9b17d6071ea13e40af5c0934f6b290cbda9e5921db4ba4f4d525ecf498f5660c9a2036d3202260727e62a1d0fee5
- SSDEEP 12288:HqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:HjHPOSOkx2LFscUQPK
- TLSH T198C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4564 6ac10580 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe Destination IP 2 223.5.5.5 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe Destination IP 9 114.114.114.114 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe Destination IP 11 223.5.5.5 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe - Drops file in System32 directory 19 IoCs
description ioc Process File created C:\Windows\SysWOW64\6ac10580 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 6ac10580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 6ac10580 -
resource yara_rule behavioral2/memory/4396-0-0x0000000000300000-0x0000000000389000-memory.dmp upx behavioral2/files/0x001d00000002b0f5-2.dat upx behavioral2/memory/4564-4-0x0000000000E60000-0x0000000000EE9000-memory.dmp upx behavioral2/memory/4396-19-0x0000000000300000-0x0000000000389000-memory.dmp upx behavioral2/memory/4396-20-0x0000000000300000-0x0000000000389000-memory.dmp upx behavioral2/memory/4564-22-0x0000000000E60000-0x0000000000EE9000-memory.dmp upx behavioral2/memory/4396-37-0x0000000000300000-0x0000000000389000-memory.dmp upx behavioral2/memory/4564-38-0x0000000000E60000-0x0000000000EE9000-memory.dmp upx behavioral2/memory/4396-64-0x0000000000300000-0x0000000000389000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4e2328 6ac10580 File opened for modification C:\Windows\4b42d8 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ac10580 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 6ac10580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 6ac10580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 6ac10580 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 6ac10580 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 6ac10580 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 6ac10580 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 6ac10580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 6ac10580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 6ac10580 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4564 6ac10580 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe Token: SeTcbPrivilege 4396 08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe Token: SeDebugPrivilege 4564 6ac10580 Token: SeTcbPrivilege 4564 6ac10580
Processes
-
C:\Users\Admin\AppData\Local\Temp\08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe"C:\Users\Admin\AppData\Local\Temp\08d6d10be1ede8e316ed84458db0138607dd44d7c7a5d6c8111062aa8f9c22e1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
C:\Windows\Syswow64\6ac10580C:\Windows\Syswow64\6ac105801⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4e2328
- Size 916B
- SHA256 2a1c72aa443c50e951a21be0adbe0cba41381b88759f58ce228b7cf79b87cece
- MD5 afc51062cea06ae16b6cf786dfd914de
- SHA1 75844b1bd83550d0f9164b21c8c4b004658cb66c
- SHA512 a036fe2771edba4524266f167c0f08ca513a42dc3162cfd33b21442e277b01d83d666e098c8b4beb4229abf28ed4e96d3fe99a2245589f5e046485f06ffc6701
- TLSH T180118063A06C15A29DDDC64B9643A9F6F1708335486423D817D2278127F3961D74353E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\6ac10580
- Size 576KB
- SHA256 e8ce6f34e55b0c0741e600070fff98644dae22d5ab47d470de6dff1255abdf3c
- MD5 b32666893a1e781a2c0222e9e9e41043
- SHA1 a3d7bcdddf5bd03a68a97a6ed8a1009c08f45624
- SHA512 6255315c280248500bb4b3521ac27ff433007a52f58e66ade858e5fde630e901984c2358467d1a57802a6233e890e179bb124e4388b9b56ee79a7a7b6ff9e0e8
- SSDEEP 12288:oqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:ojHPOSOkx2LFscUQPK
- TLSH T117C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH