Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/05/2026, 19:43
Behavioral task
behavioral1
Sample
b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe
- Size 1022KB
- Sample260502-yfap1aey41
- SHA256 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54
- MD5 0cc61a46b85f18649a2df599c7df04f5
- SHA1 331b96b38d50d00b24cead987b657bd2c77bfa45
- SHA512 2694fd347df77d064c11a19fb3c9a4bd606318b232d4a98c5e692fab2aeb2577f13a17cc1144a4565b09ce9453ef74e12e070f1d954cfada2092b7a093eeaf53
- SSDEEP 12288:OSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidT:tvO2xJKRw2kOkx2LFRvcU6UQOJdT
- TLSH T1A5256B31A681C036D5B34571C6FA4BBBA9747D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4940 9efab758 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 5 223.5.5.5 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe Destination IP 36 114.114.114.114 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe Destination IP 39 223.5.5.5 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe Destination IP 3 114.114.114.114 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\9efab758 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9efab758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9efab758 -
resource yara_rule behavioral1/memory/4724-0-0x00000000000C0000-0x000000000014C000-memory.dmp upx behavioral1/files/0x000900000002166e-2.dat upx behavioral1/memory/4940-4-0x0000000000960000-0x00000000009EC000-memory.dmp upx behavioral1/memory/4724-12-0x00000000000C0000-0x000000000014C000-memory.dmp upx behavioral1/memory/4940-13-0x0000000000960000-0x00000000009EC000-memory.dmp upx behavioral1/memory/4940-32-0x0000000000960000-0x00000000009EC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\549318 9efab758 File opened for modification C:\Windows\50e068 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9efab758 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9efab758 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9efab758 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9efab758 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9efab758 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9efab758 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9efab758 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9efab758 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9efab758 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9efab758 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 9efab758 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 9efab758 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4940 9efab758 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe Token: SeTcbPrivilege 4724 b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe Token: SeDebugPrivilege 4940 9efab758 Token: SeTcbPrivilege 4940 9efab758
Processes
-
C:\Users\Admin\AppData\Local\Temp\b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe"C:\Users\Admin\AppData\Local\Temp\b53bc671c9d40eb8559114d142852a6a37fe1f88e4e867cd10d9ca1e2ff60c54.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
C:\Windows\Syswow64\9efab758C:\Windows\Syswow64\9efab7581⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9efab758
- Size 1022KB
- SHA256 64b541218cdd63e58605fcf447254c4c0265246c0d50bb6b0e74b48f7bfe29f0
- MD5 7f312e25b6c2ccdbc29b523bb044bae1
- SHA1 43e98c52e9b4abc11156f95698139e0d6f382a7d
- SHA512 1cd87d2467d576ea89da5b130bf52a6a4d3fcb7b0af9d2ccb2ce418dc028d94afdf1dfe6e38d7c9ca6f1543847bffd4691922a73153a86416082620004dd2eb3
- SSDEEP 12288:XSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/LikGU5rCOTeidT:ivO2xJKRw2kOkx2LFRvcU6UQOJdT
- TLSH T144256B31A681C036D5B34571C6FA4BBBA9747D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH