Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/04/2026, 20:24
Behavioral task
behavioral1
Sample
6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe
- Size 768KB
- Sample260429-y6scqsf14s
- SHA256 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb
- MD5 6e0f8960e943f7fb18cca0ec1eebca4e
- SHA1 18dec9e2126b71f18f229d17de2534ea3e710651
- SHA512 0fd3f24cafc47476a14a9237ce9a4dca3b9f3cf12c65817fcea8f679c61d50dd62b7010316204352a32ed9bac3a0ec25c032a4835f609a40fbac0a02c59c065e
- SSDEEP 12288:eqXUHkUXe39sOkx2LIan5FAQjU/LikGU5rCOTeidT:ejHPOSOkx2LFscU6UQOJdT
- TLSH T131F47D31E241C036D6A74572C6FA4BBBA5247D25431161CBA7C4BA262FB76D2FA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4860 df2888c0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe Destination IP 4 223.5.5.5 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe Destination IP 29 114.114.114.114 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe Destination IP 31 223.5.5.5 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 df2888c0 File created C:\Windows\SysWOW64\df2888c0 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content df2888c0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 df2888c0 -
resource yara_rule behavioral1/memory/2484-0-0x0000000000340000-0x00000000003C9000-memory.dmp upx behavioral1/files/0x000a000000021655-2.dat upx behavioral1/memory/4860-4-0x0000000000F10000-0x0000000000F99000-memory.dmp upx behavioral1/memory/2484-20-0x0000000000340000-0x00000000003C9000-memory.dmp upx behavioral1/memory/4860-22-0x0000000000F10000-0x0000000000F99000-memory.dmp upx behavioral1/memory/2484-40-0x0000000000340000-0x00000000003C9000-memory.dmp upx behavioral1/memory/4860-42-0x0000000000F10000-0x0000000000F99000-memory.dmp upx behavioral1/memory/2484-62-0x0000000000340000-0x00000000003C9000-memory.dmp upx behavioral1/memory/2484-66-0x0000000000340000-0x00000000003C9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\533478 df2888c0 File opened for modification C:\Windows\2a86e8 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df2888c0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" df2888c0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" df2888c0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix df2888c0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" df2888c0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ df2888c0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" df2888c0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" df2888c0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing df2888c0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" df2888c0 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 4860 df2888c0 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe Token: SeTcbPrivilege 2484 6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe Token: SeDebugPrivilege 4860 df2888c0 Token: SeTcbPrivilege 4860 df2888c0
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe"C:\Users\Admin\AppData\Local\Temp\6e3a9165c18898c26d5ee2879f10d487ac8275b1699c6dedae47e07e174455cb.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
C:\Windows\Syswow64\df2888c0C:\Windows\Syswow64\df2888c01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\df2888c0
- Size 768KB
- SHA256 6d285893b76bf6944c16c0262e7d30df2bd54cea4ccd8b8d8d53ccb814aa3dff
- MD5 615f1506acb5ed1bdfae41d798779c09
- SHA1 581573751310ac90a3eb4eb8ec1446e52e6f8ac8
- SHA512 27eb7b0fd2a802ed64ef6ee5f9cf79758620edd3e0c9387648d07a4b064a6bade218088ce030138933c73e2dab9df68ba9eba9a05759f1d59bf9666afd759edc
- SSDEEP 12288:LqXUHkUXe39sOkx2LIan5FAQjU/LikGU5rCOTeidT:LjHPOSOkx2LFscU6UQOJdT
- TLSH T110F47D31E241C036D6A74572C6FA4BBBA5247D25431161CBA7C4BA262FB76D2FA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH