Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 21:27
Behavioral task
behavioral1
Sample
16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe
- Size 560KB
- Sample260424-1apyvac14l
- SHA256 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62
- MD5 3f61beecbbf924a800e9a5fcd50d4649
- SHA1 1b8cb44481f7948c68f314684d1ee991abbf8e10
- SHA512 414d09dcf9615c3842c63126a4562948f9f74d7f4e0579cd651926519efc8d52a62b9c2aa5a7e069921bee86315772868f4eb522fb8a53088c377e158215f29d
- SSDEEP 6144:NUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:NYsVOdhElvkCgvDLe4usOkxHy
- TLSH T1E3C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4148 a21b6f54 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 7 114.114.114.114 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe Destination IP 8 223.5.5.5 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe Destination IP 1 114.114.114.114 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe Destination IP 2 223.5.5.5 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a21b6f54 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a21b6f54 File created C:\Windows\SysWOW64\a21b6f54 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a21b6f54 -
resource yara_rule behavioral2/memory/2188-0-0x0000000000470000-0x00000000004FC000-memory.dmp upx behavioral2/files/0x002800000002b23d-2.dat upx behavioral2/memory/4148-3-0x0000000000CF0000-0x0000000000D7C000-memory.dmp upx behavioral2/memory/2188-10-0x0000000000470000-0x00000000004FC000-memory.dmp upx behavioral2/memory/4148-11-0x0000000000CF0000-0x0000000000D7C000-memory.dmp upx behavioral2/memory/4148-28-0x0000000000CF0000-0x0000000000D7C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\257598 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe File opened for modification C:\Windows\4703e8 a21b6f54 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a21b6f54 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a21b6f54 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a21b6f54 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a21b6f54 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a21b6f54 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a21b6f54 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a21b6f54 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a21b6f54 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a21b6f54 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a21b6f54 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4148 a21b6f54 4148 a21b6f54 4148 a21b6f54 4148 a21b6f54 4148 a21b6f54 4148 a21b6f54 4148 a21b6f54 4148 a21b6f54 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe Token: SeTcbPrivilege 2188 16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe Token: SeDebugPrivilege 4148 a21b6f54 Token: SeTcbPrivilege 4148 a21b6f54
Processes
-
C:\Users\Admin\AppData\Local\Temp\16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe"C:\Users\Admin\AppData\Local\Temp\16adeb755e2453ccd67ac2af5597395a7d59f686806cb42bb3549edf42460b62.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\Syswow64\a21b6f54C:\Windows\Syswow64\a21b6f541⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a21b6f54
- Size 560KB
- SHA256 b891c1d27615fdef06338741129bd2a46fc23af85b5963c45bab3bef44ff77fe
- MD5 5c0902e68506cc561ab8461bf76b8568
- SHA1 77a8e521fdf880ac35558bc8dab1c411a999af7c
- SHA512 5769a0f7d15bec02020c1861f4bd2bd447a5d51eb24faa4432346ca94ed438e29076317d0070e000701dae8f5cf0f62fc6c29c2b47988b3c54a29367a51f4d06
- SSDEEP 6144:OUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:OYsVOdhElvkCgvDLe4usOkxHy
- TLSH T153C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH