Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/05/2026, 19:12
Behavioral task
behavioral1
Sample
45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe
- Size 271KB
- Sample260502-xwpneses81
- SHA256 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479
- MD5 3c3c094003e71ce2301e96b0c565d12a
- SHA1 d61b702cdf0f0423e09762fd3f8d737110dc04d3
- SHA512 ab091575d96102429c7167b0524c6cf6845f7f4ae8c1674637b8ec7cdbec543cec35fa6acbb9e6b39d4af39795734015ea45fa352737f200ab4a3a44d286a521
- SSDEEP 6144:Bl51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOa:fqXUHkUXe39sOkx2LIa
- TLSH T13044CF5BF27440B6C49AD678C9935A5AFBF1B815872143CF1320C25A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4048 89d6701d - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe Destination IP 4 223.5.5.5 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe Destination IP 35 114.114.114.114 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe Destination IP 38 223.5.5.5 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 89d6701d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89d6701d File created C:\Windows\SysWOW64\89d6701d 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe -
resource yara_rule behavioral1/memory/536-0-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx behavioral1/files/0x001e0000000242ff-2.dat upx behavioral1/memory/4048-3-0x00000000002A0000-0x0000000000329000-memory.dmp upx behavioral1/memory/536-12-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx behavioral1/memory/4048-14-0x00000000002A0000-0x0000000000329000-memory.dmp upx behavioral1/memory/536-32-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx behavioral1/memory/4048-33-0x00000000002A0000-0x0000000000329000-memory.dmp upx behavioral1/memory/536-55-0x0000000000CE0000-0x0000000000D69000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\454da0 89d6701d File opened for modification C:\Windows\92d30 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89d6701d - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 89d6701d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 89d6701d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 89d6701d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 89d6701d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 89d6701d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 89d6701d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 89d6701d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 89d6701d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 89d6701d - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 4048 89d6701d 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe Token: SeTcbPrivilege 536 45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe Token: SeDebugPrivilege 4048 89d6701d Token: SeTcbPrivilege 4048 89d6701d
Processes
-
C:\Users\Admin\AppData\Local\Temp\45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe"C:\Users\Admin\AppData\Local\Temp\45c08acfcc6dcf021e84995f6f5d8f8e610a99447210dc037481c4bf787e0479.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536
-
C:\Windows\Syswow64\89d6701dC:\Windows\Syswow64\89d6701d1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\89d6701d
- Size 271KB
- SHA256 62e73dca003da4dbe9df089ec3aaf2665b9e8a99cee81a4c4ef9fdc5da22f3b5
- MD5 d08e0b69d6c00d07f5c63f2684065415
- SHA1 f863743f9a5c0a0c59ecb051642fab1b755eb7dd
- SHA512 943bbbeb9a842b1cf5ac839e9eb9fcb180e00e670c7932904475d231fe44e3d1370bb32680a511f44d49398489d0045f7af9bcc2a53e386f9e515cdb9882944b
- SSDEEP 6144:bl51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOa:dqXUHkUXe39sOkx2LIa
- TLSH T16C44CF5BF27440B6C49AD678C9935A5AFBF1B815872143CF1320C25A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH