Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/05/2026, 19:53
Behavioral task
behavioral1
Sample
d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe
- Size 832KB
- Sample260501-yl145scx21
- SHA256 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7
- MD5 131a047f36116c377bce1e2fafdd1f84
- SHA1 a4f61e6a6a396c4740f3f8d7e0aa366dfdc4018e
- SHA512 22ed2cbd49236f1a742311a610aac144f19612edf0708f6e57bcd9cc584f3f7b00f276ff591431c7412cf7c412f643d387db9fa26e76384cfc32f1bdd8a4f506
- SSDEEP 12288:cqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:cjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T132059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4892 9c1dd291 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe Destination IP 2 223.5.5.5 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe Destination IP 8 114.114.114.114 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe Destination IP 9 223.5.5.5 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9c1dd291 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9c1dd291 File created C:\Windows\SysWOW64\9c1dd291 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe -
resource yara_rule behavioral2/memory/4036-0-0x0000000000ED0000-0x0000000000F59000-memory.dmp upx behavioral2/files/0x002100000002b1ae-3.dat upx behavioral2/memory/4892-4-0x0000000000890000-0x0000000000919000-memory.dmp upx behavioral2/memory/4036-17-0x0000000000ED0000-0x0000000000F59000-memory.dmp upx behavioral2/memory/4892-19-0x0000000000890000-0x0000000000919000-memory.dmp upx behavioral2/memory/4036-33-0x0000000000ED0000-0x0000000000F59000-memory.dmp upx behavioral2/memory/4892-35-0x0000000000890000-0x0000000000919000-memory.dmp upx behavioral2/memory/4036-45-0x0000000000ED0000-0x0000000000F59000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\53c0b8 9c1dd291 File opened for modification C:\Windows\451908 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c1dd291 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9c1dd291 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9c1dd291 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9c1dd291 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9c1dd291 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9c1dd291 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9c1dd291 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9c1dd291 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9c1dd291 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9c1dd291 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4892 9c1dd291 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe Token: SeTcbPrivilege 4036 d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe Token: SeDebugPrivilege 4892 9c1dd291 Token: SeTcbPrivilege 4892 9c1dd291
Processes
-
C:\Users\Admin\AppData\Local\Temp\d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe"C:\Users\Admin\AppData\Local\Temp\d358eb1a85065667df28832f5c913e60501521e6ed38e0575b6933e3e67c2ad7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
C:\Windows\Syswow64\9c1dd291C:\Windows\Syswow64\9c1dd2911⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\53c0b8
- Size 916B
- SHA256 fe19eae285e345c2fd9a9fa95a2874f95497d797bbe998218710cac8b6877818
- MD5 ce8bfae219267d62e50724ad4e8e3b22
- SHA1 e9fc6a8bbcf09ce2705c1cc4d3e5cb8f3533252b
- SHA512 1fa3b1c096ddbf90f204fe2c657be78e797d9b91a747bfd7e6a4c06db020e5e4fa727641fe715c82356d18f13f6cb9b8d6ebe37e534f46e19b6f9bbf0f921ce1
- TLSH T1961180B3A44362B30DE9A50F56C025CFB164D153945F26E13E917AD71BB38E00B0220A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\9c1dd291
- Size 832KB
- SHA256 5fef6e09874076a434db00663fc683afd05680438f43148c9368ed44f6e1141d
- MD5 3a3ec42521bd9509b0feb44dab7dc931
- SHA1 2f1cbeea1212d92ddc3fc3879ec5d384f70fcd00
- SHA512 b646dd79e76ec411781ff30fa485a302907fb26b8bdbfb0ffa19ee55135a1239555482b29bc4a690b6026b2170a940d6193143270169576adecc24c07da21c61
- SSDEEP 12288:eqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:ejHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T1DE059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH