Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 23:52
Behavioral task
behavioral1
Sample
533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe
- Size 560KB
- Sample260426-3wt6ssat2x
- SHA256 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc
- MD5 fe1a71e8fde93285def5357c3fabdf18
- SHA1 35b7afb1cbab578b143beef35c69990f5ca19be1
- SHA512 c7705f44ed58dbb2739f1c0f953330b529cd4bdfd53d147e90f0f10d48611a52544b4f641b09365fb832e986df6d2ddc7b6ea37b35bf95f4a44e57e12c1f0c43
- SSDEEP 6144:E6UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:EO7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T155C46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5108 6f170d7c - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Destination IP 4 223.5.5.5 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Destination IP 43 114.114.114.114 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Destination IP 44 223.5.5.5 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Destination IP 108 114.114.114.114 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Destination IP 109 223.5.5.5 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 6f170d7c File created C:\Windows\SysWOW64\6f170d7c 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 6f170d7c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6f170d7c -
resource yara_rule behavioral1/memory/4588-0-0x0000000000370000-0x00000000003FC000-memory.dmp upx behavioral1/files/0x00080000000242a5-2.dat upx behavioral1/memory/5108-4-0x0000000000F50000-0x0000000000FDC000-memory.dmp upx behavioral1/memory/4588-13-0x0000000000370000-0x00000000003FC000-memory.dmp upx behavioral1/memory/5108-14-0x0000000000F50000-0x0000000000FDC000-memory.dmp upx behavioral1/memory/5108-30-0x0000000000F50000-0x0000000000FDC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\577368 6f170d7c File opened for modification C:\Windows\4e8c58 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f170d7c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 6f170d7c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 6f170d7c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 6f170d7c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 6f170d7c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 6f170d7c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 6f170d7c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 6f170d7c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 6f170d7c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 6f170d7c - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5108 6f170d7c 5108 6f170d7c 5108 6f170d7c 5108 6f170d7c 5108 6f170d7c 5108 6f170d7c 5108 6f170d7c 5108 6f170d7c 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Token: SeTcbPrivilege 4588 533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe Token: SeDebugPrivilege 5108 6f170d7c Token: SeTcbPrivilege 5108 6f170d7c
Processes
-
C:\Users\Admin\AppData\Local\Temp\533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe"C:\Users\Admin\AppData\Local\Temp\533b835a5905f25e2e3e4ce661833e2f682780213570f078b4496952f18302cc.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
C:\Windows\Syswow64\6f170d7cC:\Windows\Syswow64\6f170d7c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\6f170d7c
- Size 560KB
- SHA256 981517f670ade8c31356edcceb7c1b52905b1921c98181aac20a6d282adb1dff
- MD5 5684c283c8db87ee5baed090f95a9509
- SHA1 3fb1c3236a42a973c6401fb1a382d25d87811e9f
- SHA512 1f35e4561d5a2378a2caac720d5d59ba5dc9efc2ce99efc1a78dd4052ce15e507b239e8ea052aa71bc9044184d0dd74ded784e941c897bd49912b32c99a4177b
- SSDEEP 6144:46UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:4O7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T15FC46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH