Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 18:44
Behavioral task
behavioral1
Sample
6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe
- Size 548KB
- Sample260423-xdz2faew5k
- SHA256 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3
- MD5 1f7d573c099ec9f6b0df398e117bd251
- SHA1 a3a525bd4f7ebd7960a318b7f667f266d131683a
- SHA512 4e2e209ba924cfc4b8f6c4f250d68cfaff39e500e1429dc899f8a7d4ea89ff0536a74bb9e3bdf2b3553a857eb40b7f1a062d0952ab3582a907823a07b2d2db06
- SSDEEP 12288:DkbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:IbOgbEqy9RKejHPOwOkx2LF
- TLSH T157C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3364 2a8a60d8 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 213 223.5.5.5 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 3 114.114.114.114 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 74 114.114.114.114 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 131 223.5.5.5 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 6 223.5.5.5 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 63 114.114.114.114 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 64 223.5.5.5 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 75 223.5.5.5 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 129 114.114.114.114 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Destination IP 212 114.114.114.114 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\2a8a60d8 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 2a8a60d8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 2a8a60d8 -
resource yara_rule behavioral1/memory/4132-0-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral1/memory/3364-4-0x0000000000CF0000-0x0000000000D79000-memory.dmp upx behavioral1/files/0x00030000000230d7-3.dat upx behavioral1/memory/4132-10-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral1/memory/3364-12-0x0000000000CF0000-0x0000000000D79000-memory.dmp upx behavioral1/memory/4132-37-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral1/memory/3364-38-0x0000000000CF0000-0x0000000000D79000-memory.dmp upx behavioral1/memory/3364-44-0x0000000000CF0000-0x0000000000D79000-memory.dmp upx behavioral1/memory/4132-47-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral1/memory/4132-50-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral1/memory/4132-53-0x00000000004A0000-0x0000000000529000-memory.dmp upx behavioral1/memory/4132-54-0x00000000004A0000-0x0000000000529000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3997c8 2a8a60d8 File opened for modification C:\Windows\46bdc8 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a8a60d8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2a8a60d8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2a8a60d8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 2a8a60d8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2a8a60d8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2a8a60d8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2a8a60d8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2a8a60d8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2a8a60d8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2a8a60d8 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 2a8a60d8 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 2a8a60d8 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3364 2a8a60d8 3364 2a8a60d8 3364 2a8a60d8 3364 2a8a60d8 3364 2a8a60d8 3364 2a8a60d8 3364 2a8a60d8 3364 2a8a60d8 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Token: SeTcbPrivilege 4132 6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe Token: SeDebugPrivilege 3364 2a8a60d8 Token: SeTcbPrivilege 3364 2a8a60d8
Processes
-
C:\Users\Admin\AppData\Local\Temp\6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe"C:\Users\Admin\AppData\Local\Temp\6853038fc2a21483a0634636a83d58b1ed73478228556df3a1e090b81710dee3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
C:\Windows\Syswow64\2a8a60d8C:\Windows\Syswow64\2a8a60d81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\2a8a60d8
- Size 548KB
- SHA256 f4faaa9e1ca4b7b87008f9405d5f8c090d92834359301126bf3730cf061b1e70
- MD5 dc256b11a8f7763526ca3709a6231355
- SHA1 10b850cb3f60ce9de7527f88fe4b4965ec38cd39
- SHA512 8e5e8062f42a85faf8c066c3f5aa8bc39a2837121621233d758e9d5ec7a188fa4ac9bbb4f1858e85123f75311bd9709448415595f249769ab03e3145d5a91e44
- SSDEEP 12288:kkbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:9bOgbEqy9RKejHPOwOkx2LF
- TLSH T17EC4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH