0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
Size 1024KB
Sample260428-sfbpeabs51
SHA256 0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d
MD5 97bd781a2e0425d16ee20426dd1a4e20
SHA1 3c1ceef17fbddbd9801835dda54fa9c8f44d286f
SHA512 112ce1075d8713c456da2c1007875ed17cee84e89e816a08946d21c4485650ae0fa3d53dea9af124fd49054cacb2debf1112eaddbb4e236ad7a4dd3372aba1a9
SSDEEP 12288:OqXUHkUXe39sOkx2LIan5FAQjU/LikGU5rCOTeidzN/VT1CRLsCP3xHP:OjHPOSOkx2LFscU6UQOJdBqsCPhHP
TLSH
T1D225AF30E245C036D1A74572C6FA4BBBA5287D25431161CB63C4BA3A2FB76D2EA3171F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1472	1af9bd78

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	13	223.5.5.5	4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
Destination IP	1	114.114.114.114	4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
Destination IP	2	223.5.5.5	4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
Destination IP	12	114.114.114.114	4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C	1af9bd78
File created	C:\Windows\SysWOW64\1af9bd78	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	1af9bd78
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C	1af9bd78

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4004-0-0x0000000000B20000-0x0000000000BA9000-memory.dmp	upx
behavioral2/files/0x0008000000000436-2.dat	upx
behavioral2/memory/1472-4-0x0000000000590000-0x0000000000619000-memory.dmp	upx
behavioral2/memory/4004-15-0x0000000000B20000-0x0000000000BA9000-memory.dmp	upx
behavioral2/memory/1472-17-0x0000000000590000-0x0000000000619000-memory.dmp	upx
behavioral2/memory/1472-28-0x0000000000590000-0x0000000000619000-memory.dmp	upx
behavioral2/memory/4004-37-0x0000000000B20000-0x0000000000BA9000-memory.dmp	upx
behavioral2/memory/1472-39-0x0000000000590000-0x0000000000619000-memory.dmp	upx
behavioral2/memory/1472-46-0x0000000000590000-0x0000000000619000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\193380	1af9bd78
File opened for modification	C:\Windows\448cc8	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1af9bd78

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	1af9bd78
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	1af9bd78
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	1af9bd78
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	1af9bd78
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	1af9bd78
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	1af9bd78
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	1af9bd78
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	1af9bd78
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	1af9bd78

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1472	1af9bd78
1472	1af9bd78
1472	1af9bd78
1472	1af9bd78
1472	1af9bd78
1472	1af9bd78
1472	1af9bd78
1472	1af9bd78
4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
Token: SeTcbPrivilege	4004	0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
Token: SeDebugPrivilege	1472	1af9bd78
Token: SeTcbPrivilege	1472	1af9bd78

C:\Users\Admin\AppData\Local\Temp\0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe
"C:\Users\Admin\AppData\Local\Temp\0085c9fb30d1684565032f4e1b3f04e6f2b94dfda197547e2b31fa69c553b15d.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\Syswow64\1af9bd78
C:\Windows\Syswow64\1af9bd78
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1af9bd78

Path C:\Windows\SysWOW64\1af9bd78
Size 1024KB
SHA256 5904a1c1d91fe99799fa3388da6934607ff4c2eb3547dc5bdc95beafba035f9a
MD5 715b911d7133b071fda3385d1fdeea1a
SHA1 76852d749531bfa1d6da0d8e6bf69dbcd6c109ca
SHA512 7183da87205db4795c94c2461d477ef56012b37ffae293bc93df9304447614f3afd2244688e4dfa4931ffa2aed565ffabc61bd98a4c55470ff0f0365ca61debc
SSDEEP 12288:OqXUHkUXe39sOkx2LIan5FAQjU/LikGU5rCOTeidzN/VT1CRLsCP3xHP:OjHPOSOkx2LFscU6UQOJdBqsCPhHP
TLSH
T15B25AF30E245C036D1A74572C6FA4BBBA5287D25431161CB63C4BA3A2FB76D2EA3171F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1472-4-0x0000000000590000-0x0000000000619000-memory.dmp

Download

memory/1472-17-0x0000000000590000-0x0000000000619000-memory.dmp

Download

memory/1472-18-0x0000000001FF0000-0x0000000002054000-memory.dmp

Download

memory/1472-28-0x0000000000590000-0x0000000000619000-memory.dmp

Download

memory/1472-39-0x0000000000590000-0x0000000000619000-memory.dmp

Download

memory/1472-46-0x0000000000590000-0x0000000000619000-memory.dmp

Download

memory/4004-0-0x0000000000B20000-0x0000000000BA9000-memory.dmp

Download

memory/4004-15-0x0000000000B20000-0x0000000000BA9000-memory.dmp

Download

memory/4004-37-0x0000000000B20000-0x0000000000BA9000-memory.dmp

Download

memory/4004-38-0x0000000002C30000-0x0000000002C94000-memory.dmp

Download