Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 03:47
Behavioral task
behavioral1
Sample
e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe
- Size 1.7MB
- Sample260424-ecmqlsd17x
- SHA256 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9
- MD5 19baacfd56ffd5414805e5b231595bf7
- SHA1 41ee67c1b72a79e71c09c89573f3739078442c03
- SHA512 001b6fc502530b38ba27147d41dc581cdf2b36b39ba56b7592429816478fc70a89a84571b08b1cfa3d1ff8e51fdbadc9f9a14a4cad35f7b180f3ed088c3ce828
- SSDEEP 24576:EvO2xJKRh2kOkx2LFxNcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:EHHKX2WQt56/OJdJCXDrsOFZMjHfUr
- TLSH T141858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5212 72af6698 - Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 51 223.5.5.5 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Destination IP 62 114.114.114.114 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Destination IP 63 223.5.5.5 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Destination IP 131 114.114.114.114 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Destination IP 132 223.5.5.5 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Destination IP 3 114.114.114.114 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Destination IP 4 223.5.5.5 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Destination IP 50 114.114.114.114 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 72af6698 File created C:\Windows\SysWOW64\72af6698 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 72af6698 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 72af6698 -
resource yara_rule behavioral1/memory/4268-0-0x0000000000F70000-0x0000000000FFC000-memory.dmp upx behavioral1/files/0x000b0000000243e7-2.dat upx behavioral1/memory/5212-4-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral1/memory/4268-18-0x0000000000F70000-0x0000000000FFC000-memory.dmp upx behavioral1/memory/5212-19-0x0000000000080000-0x000000000010C000-memory.dmp upx behavioral1/memory/5212-32-0x0000000000080000-0x000000000010C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\593b38 72af6698 File opened for modification C:\Windows\4911d8 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72af6698 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 72af6698 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 72af6698 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 72af6698 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 72af6698 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 72af6698 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 72af6698 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 72af6698 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 72af6698 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 72af6698 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 5212 72af6698 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Token: SeTcbPrivilege 4268 e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe Token: SeDebugPrivilege 5212 72af6698 Token: SeTcbPrivilege 5212 72af6698
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe"C:\Users\Admin\AppData\Local\Temp\e9c19768506a90d907defd630f84fe0e0a9a666536f510f030a1c79b5a0087c9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
C:\Windows\Syswow64\72af6698C:\Windows\Syswow64\72af66981⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\72af6698
- Size 1.7MB
- SHA256 7a344b44b776e7db29d335d7a5065e0f35cc5bb695da3e6f7dba0f31d9584ee5
- MD5 56583eec7837a0cd72958080d8338fa6
- SHA1 5686ea5273e3dab3f2a0ae209d6e67049fb4942a
- SHA512 331b8b4a4d54734eac8e9da101478590d17d801a3293730709a240573c4be4185c5d73cb58b37b2c8f1b7cf08b33df43bc189e021f53f4308b7f9f491192b4ae
- SSDEEP 24576:vvO2xJKRh2kOkx2LFxNcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:vHHKX2WQt56/OJdJCXDrsOFZMjHfUr
- TLSH T180858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH