Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/04/2026, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe
- Size 395KB
- Sample260428-ynlr8sd19v
- SHA256 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d
- MD5 61aa3bffc711d3b5cf65bc9196e4ff21
- SHA1 4814959338df9f6b50d412ace2865b0278881f4e
- SHA512 1d4edb8faf10d1238008429c664fe343d27ad215a7bf60d4126cdcb9ee6faced477b90ab1169d77aa76701a1d01710153b9848c885ed445582f40b5e78e1d996
- SSDEEP 6144:ag/AL1cVUoG1XRlL0wcJtL2KmEFEcEOkCybEaQRXr9HNdvOaty8K:anLOVWLlowcJtL2KyOkx2LIaty
- TLSH T130847C26F6A08036C5B79578C4A396A6FFB1742137248ACFA390475A1F237E2BD3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4728 e379ba6 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 114.114.114.114 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe Destination IP 3 223.5.5.5 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe Destination IP 22 114.114.114.114 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe Destination IP 23 223.5.5.5 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e379ba6 File created C:\Windows\SysWOW64\e379ba6 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e379ba6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e379ba6 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\50f1f0 e379ba6 File opened for modification C:\Windows\4ec0f0 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e379ba6 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e379ba6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e379ba6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e379ba6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e379ba6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e379ba6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e379ba6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e379ba6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e379ba6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e379ba6 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4728 e379ba6 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe Token: SeTcbPrivilege 4600 4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe Token: SeDebugPrivilege 4728 e379ba6 Token: SeTcbPrivilege 4728 e379ba6
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe"C:\Users\Admin\AppData\Local\Temp\4d3025f2110da88478f5021d5e4c2da2bcc15a7dde66b0a37a996f19b3e21d8d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
C:\Windows\Syswow64\e379ba6C:\Windows\Syswow64\e379ba61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e379ba6
- Size 395KB
- SHA256 d695e5ffad32a4367b2ee066e146a9b88f2951038aef65c46ad84b9e34ea071b
- MD5 45e33af07b2edef0ac22cd4896b77e36
- SHA1 629888f03044b4fa91c28f5b9495acb891652427
- SHA512 6ff85bb212238d163d7e36fec92633cb826ac1d2af452f4bdae43587f56b7a0291d36037fe23d2c1f36637199d57a46f0185cbe494ebe5d88fe55822c8ae89ea
- SSDEEP 6144:wg/AL1cVUoG1XRlL0wcJtL2KmEFEcEOkCybEaQRXr9HNdvOaty8K:wnLOVWLlowcJtL2KyOkx2LIaty
- TLSH T138847C26F6A08036C5B79578C4A396A6FFB1742137248ACFA390475A1F237E2BD3531D
- MD5 SHA1 SHA512 SSDEEP TLSH