Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 22:52
Behavioral task
behavioral1
Sample
f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe
- Size 560KB
- Sample260426-2te4eshy2s
- SHA256 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5
- MD5 1fcd8a2c77f986e217c9a7b9e33f805c
- SHA1 eb98ef475b3a0355331f1e4475a10dc04369e608
- SHA512 988dc77e7b0ec2d9bf03650df93287d79fb06e6946c871a60e31fe40a1128212187124dcab52dd3c90e8dfac74d8bb2e33f371569bc7f8e3f7fd553d6b707a89
- SSDEEP 6144:gLgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:aI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T1C8C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4564 183f7fbe - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 31 223.5.5.5 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe Destination IP 1 114.114.114.114 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe Destination IP 4 223.5.5.5 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe Destination IP 30 114.114.114.114 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 183f7fbe File created C:\Windows\SysWOW64\183f7fbe f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 183f7fbe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 183f7fbe -
resource yara_rule behavioral1/memory/4356-0-0x00000000001E0000-0x000000000026C000-memory.dmp upx behavioral1/files/0x000f000000021658-2.dat upx behavioral1/memory/4564-4-0x00000000009A0000-0x0000000000A2C000-memory.dmp upx behavioral1/memory/4356-12-0x00000000001E0000-0x000000000026C000-memory.dmp upx behavioral1/memory/4564-13-0x00000000009A0000-0x0000000000A2C000-memory.dmp upx behavioral1/memory/4564-32-0x00000000009A0000-0x0000000000A2C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4e2328 183f7fbe File opened for modification C:\Windows\4a9388 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183f7fbe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 183f7fbe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 183f7fbe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 183f7fbe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 183f7fbe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 183f7fbe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 183f7fbe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 183f7fbe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 183f7fbe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 183f7fbe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4564 183f7fbe 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe Token: SeTcbPrivilege 4356 f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe Token: SeDebugPrivilege 4564 183f7fbe Token: SeTcbPrivilege 4564 183f7fbe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe"C:\Users\Admin\AppData\Local\Temp\f171ef903426cf11464677cab7789bf2b1266dcb193fbc5fb2973a7818d573f5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
C:\Windows\Syswow64\183f7fbeC:\Windows\Syswow64\183f7fbe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\183f7fbe
- Size 560KB
- SHA256 9fe1bb6051235b7a52277997916db1d2e1be5adcf55645c329efdba02a9d8e4a
- MD5 a2675d553719720737aa2041e7763a53
- SHA1 638aeb864f96ae6453327077e86c4fb0229db19e
- SHA512 e363fbdcc7720e3df6a9795a4bfec45503ba6fa463f1fe20370e9cecc20420bd7c6b120b4b88ab9348a7465cfddb9ed9c17b48807a21f209153957552e1de042
- SSDEEP 6144:5gye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:5I7OE4kopQzNKFyLWDHsOkxHy
- TLSH T15BC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH