Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 22:24
Behavioral task
behavioral1
Sample
6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe
- Size 640KB
- Sample260423-2bkaesht3p
- SHA256 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17
- MD5 da7e7b8a1571abafbcea790375ce1af0
- SHA1 9e086c749908c99867cf28cd2de11f10d175f41c
- SHA512 2e7daf1748357ea6ead0dbccda8cc1703112994dec55c5c9149bd67aa84239b9a7eb45f17d3585ab1d4b4a81a40e693dd2845f4fd21e7a0adad91c8aba8f1878
- SSDEEP 6144:RcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:RSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T126D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1016 c1f4b440 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe Destination IP 2 223.5.5.5 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe Destination IP 8 114.114.114.114 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe Destination IP 9 223.5.5.5 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 c1f4b440 File created C:\Windows\SysWOW64\c1f4b440 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c1f4b440 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c1f4b440 -
resource yara_rule behavioral2/memory/2012-0-0x0000000000900000-0x000000000098C000-memory.dmp upx behavioral2/files/0x004f00000002b191-2.dat upx behavioral2/memory/1016-4-0x0000000000C40000-0x0000000000CCC000-memory.dmp upx behavioral2/memory/2012-17-0x0000000000900000-0x000000000098C000-memory.dmp upx behavioral2/memory/1016-19-0x0000000000C40000-0x0000000000CCC000-memory.dmp upx behavioral2/memory/1016-42-0x0000000000C40000-0x0000000000CCC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1164f0 c1f4b440 File opened for modification C:\Windows\227238 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1f4b440 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c1f4b440 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c1f4b440 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c1f4b440 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c1f4b440 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c1f4b440 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c1f4b440 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c1f4b440 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c1f4b440 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c1f4b440 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 1016 c1f4b440 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe Token: SeTcbPrivilege 2012 6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe Token: SeDebugPrivilege 1016 c1f4b440 Token: SeTcbPrivilege 1016 c1f4b440
Processes
-
C:\Users\Admin\AppData\Local\Temp\6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe"C:\Users\Admin\AppData\Local\Temp\6253a73dad466cdfc6cc5dd08ae0096a8a233cca980eeb5d6f3fbf5f1b2a2d17.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
C:\Windows\Syswow64\c1f4b440C:\Windows\Syswow64\c1f4b4401⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1164f0
- Size 916B
- SHA256 c12734772f0fc8ba0279191b859ccdb7c55be3e182ee93ae38a8c663de590213
- MD5 d35652d410f95d911416de11e23eea81
- SHA1 ea68eaded30279fb90b4a48203eefb15b4e7a087
- SHA512 1763c4e599326579c604d5b1ecdcec083070e7468aa44fdf8350326cf2003f47f4f2aa726803c512db92288665b708a38b98e6b141e99f4b2fb2d72ba3157bc0
- TLSH T132113175319D1FB2CE794D1DC75D1088B433640681BA246837E7220B30A36B65E0B6E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\c1f4b440
- Size 640KB
- SHA256 976312a01377dd699bb82506c3f7a9dd5124c07f269fdf8b7fa812e4e14c400a
- MD5 e9ec682906c94b7d209af8d3254f83a8
- SHA1 ab5e6f7cc6cc7ae0dda797ab6c7046fe7724f8b2
- SHA512 f966b73d91a22106e8c1ce08fa3d030660d9fea53fc9623faa5cd220778a46c5fb2060813b159bedb52ada835297d3c4182e0f96b884e2f82f78c7338c0dbc15
- SSDEEP 6144:DcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:DSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T19DD45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH