Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/05/2026, 19:08
Behavioral task
behavioral1
Sample
54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe
- Size 548KB
- Sample260502-xtdhdaes5w
- SHA256 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9
- MD5 62351d96512d981b0bf1b0e0bd23ec5b
- SHA1 201f45c861c6a34e61857283774d82a32b6ec247
- SHA512 c1ca4ad468916edc46225dbf201fd9c9b9843c897419827d917e63b8c366d1ffeb1b95e435500f4588402b28ac348937cc4655282fceebc3dd0a4ea853b6d11f
- SSDEEP 12288:1kbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:abOgbEqy9RKejHPOwOkx2LF
- TLSH T1D1C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2472 ff660284 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 43 114.114.114.114 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 99 114.114.114.114 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 100 223.5.5.5 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 154 114.114.114.114 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 155 223.5.5.5 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 1 114.114.114.114 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 35 114.114.114.114 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 36 223.5.5.5 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Destination IP 44 223.5.5.5 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\ff660284 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ff660284 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ff660284 -
resource yara_rule behavioral2/memory/4836-0-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/files/0x0012000000026154-2.dat upx behavioral2/memory/2472-3-0x0000000000F60000-0x0000000000FE9000-memory.dmp upx behavioral2/memory/4836-18-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/2472-20-0x0000000000F60000-0x0000000000FE9000-memory.dmp upx behavioral2/memory/2472-21-0x0000000000F60000-0x0000000000FE9000-memory.dmp upx behavioral2/memory/4836-38-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/2472-39-0x0000000000F60000-0x0000000000FE9000-memory.dmp upx behavioral2/memory/4836-51-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral2/memory/4836-52-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\52cb48 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe File opened for modification C:\Windows\2a5250 ff660284 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff660284 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ff660284 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ff660284 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ff660284 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ff660284 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ff660284 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ff660284 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ff660284 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ff660284 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ff660284 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2472 ff660284 2472 ff660284 2472 ff660284 2472 ff660284 2472 ff660284 2472 ff660284 2472 ff660284 2472 ff660284 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Token: SeTcbPrivilege 4836 54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe Token: SeDebugPrivilege 2472 ff660284 Token: SeTcbPrivilege 2472 ff660284
Processes
-
C:\Users\Admin\AppData\Local\Temp\54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe"C:\Users\Admin\AppData\Local\Temp\54bd1555b2957a6fc0b4161c27feca7261db8785f546034af0ee4a1a3b274be9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
C:\Windows\Syswow64\ff660284C:\Windows\Syswow64\ff6602841⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ff660284
- Size 548KB
- SHA256 b2fe482bf2f1a87d522c26973713b9f3b36a9881a20173d1c2110966162d6961
- MD5 8bdf25ac5f81d37a1206670969c5c629
- SHA1 c9dbe8cf7385288de72e9a3dc898150567084427
- SHA512 384f4fa2f9a888d671f1d025958cb41eee4209e915914432ef984b9149916a3586c9dbd464712b8d167398971b8f4577312d252c4cfb9f6fbf482cc310f7ce21
- SSDEEP 12288:TkbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:4bOgbEqy9RKejHPOwOkx2LF
- TLSH T121C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH