Analysis
- max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 04:24
Behavioral task
behavioral1
Sample
d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe
- Size 560KB
- Sample260425-e1kwxsfs8w
- SHA256 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942
- MD5 a466598e23e5c1e26b7472ba8c477d65
- SHA1 8ffbb41133e72eecef201da7caf003b02c6ef23e
- SHA512 f2effe1b4182fbbd5d9ce223d782ed96eb88d4ac8e2d187b130d2bc2162d2e5fbf59333a6d08d7d8632466d3e1dd2cc41b24cdec4eac1f5a8cac09aceccd1990
- SSDEEP 6144:MUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:MYsVOdhElvkCgvDLe4usOkxHy
- TLSH T1E3C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4476 58ef2829 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 50 114.114.114.114 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 62 114.114.114.114 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 127 114.114.114.114 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 130 223.5.5.5 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 3 114.114.114.114 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 4 223.5.5.5 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 51 223.5.5.5 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 64 223.5.5.5 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 203 114.114.114.114 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Destination IP 204 223.5.5.5 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 58ef2829 File created C:\Windows\SysWOW64\58ef2829 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 58ef2829 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 58ef2829 -
resource yara_rule behavioral1/memory/4480-0-0x0000000000890000-0x000000000091C000-memory.dmp upx behavioral1/files/0x000b0000000243e7-2.dat upx behavioral1/memory/4476-4-0x0000000000F90000-0x000000000101C000-memory.dmp upx behavioral1/memory/4480-18-0x0000000000890000-0x000000000091C000-memory.dmp upx behavioral1/memory/4476-19-0x0000000000F90000-0x000000000101C000-memory.dmp upx behavioral1/memory/4476-34-0x0000000000F90000-0x000000000101C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4ca178 58ef2829 File opened for modification C:\Windows\4cb300 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58ef2829 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 58ef2829 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 58ef2829 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 58ef2829 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 58ef2829 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 58ef2829 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 58ef2829 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 58ef2829 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 58ef2829 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 58ef2829 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4476 58ef2829 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Token: SeTcbPrivilege 4480 d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe Token: SeDebugPrivilege 4476 58ef2829 Token: SeTcbPrivilege 4476 58ef2829
Processes
-
C:\Users\Admin\AppData\Local\Temp\d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe"C:\Users\Admin\AppData\Local\Temp\d680d0a934f275dec1b7ea8c26c3495deda46967e08c4a4271a03ef45ab13942.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
C:\Windows\Syswow64\58ef2829C:\Windows\Syswow64\58ef28291⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\58ef2829
- Size 560KB
- SHA256 97f2609ba90b5a41bd17a461341b1bdd9a3698b2897f9f9497759f2d8d3edd4a
- MD5 424e6afe20f3341ccc03fa65f154bbaa
- SHA1 2934726fefd032554997037c2c4b6806c0ad28d3
- SHA512 54ee07cd7577e48589cde8b360d74ab262f9312e28463d0f2e32626a7df0936d6c44f1b72a851978c35c86fee80c72d866c1eff95e746f80bc38a07e6c9847ff
- SSDEEP 6144:yUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:yYsVOdhElvkCgvDLe4usOkxHy
- TLSH T151C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH