Analysis
- max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 20:20
Behavioral task
behavioral1
Sample
f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe
- Size 761KB
- Sample260503-y4k6msgx6v
- SHA256 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9
- MD5 219a82f45856e32c57ccb0dc956a9f23
- SHA1 b4010c03d553e6c99719826e433091d61393f969
- SHA512 a599dc05077e9c5c0dc6154ed349bfb3b8cf4f6975ef8f34ccc037b938297cff11e6332f2ff0f055ba0d110e64caaaedc016bfe0b75644d930561edd76598049
- SSDEEP 12288:zSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:GvO2xJKRw2kOkxSkW298B
- TLSH T12EF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5100 cbef0d6 - Unexpected DNS network traffic destination 12 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 65 114.114.114.114 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 118 114.114.114.114 5100 cbef0d6 Destination IP 207 114.114.114.114 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 208 223.5.5.5 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 2 223.5.5.5 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 35 114.114.114.114 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 36 223.5.5.5 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 67 223.5.5.5 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 122 114.114.114.114 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 123 223.5.5.5 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 126 223.5.5.5 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Destination IP 1 114.114.114.114 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cbef0d6 File created C:\Windows\SysWOW64\cbef0d6 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cbef0d6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cbef0d6 -
resource yara_rule behavioral2/memory/2228-0-0x0000000000300000-0x000000000038C000-memory.dmp upx behavioral2/files/0x0010000000027002-2.dat upx behavioral2/memory/5100-4-0x0000000000070000-0x00000000000FC000-memory.dmp upx behavioral2/memory/2228-18-0x0000000000300000-0x000000000038C000-memory.dmp upx behavioral2/memory/5100-19-0x0000000000070000-0x00000000000FC000-memory.dmp upx behavioral2/memory/5100-36-0x0000000000070000-0x00000000000FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\575058 cbef0d6 File opened for modification C:\Windows\2624e8 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cbef0d6 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cbef0d6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cbef0d6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cbef0d6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cbef0d6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cbef0d6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cbef0d6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cbef0d6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cbef0d6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cbef0d6 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5100 cbef0d6 5100 cbef0d6 5100 cbef0d6 5100 cbef0d6 5100 cbef0d6 5100 cbef0d6 5100 cbef0d6 5100 cbef0d6 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Token: SeTcbPrivilege 2228 f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe Token: SeDebugPrivilege 5100 cbef0d6 Token: SeTcbPrivilege 5100 cbef0d6
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe"C:\Users\Admin\AppData\Local\Temp\f0585c68f92cef1d736587c76f43d0100e75e1f0ad4504c3eab7efddf5e940c9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
C:\Windows\Syswow64\cbef0d6C:\Windows\Syswow64\cbef0d61⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cbef0d6
- Size 761KB
- SHA256 26c79f3a29c3d897eba7ea7f7e32bdedf24e62bf72fa4237b5d46b5c38c56a88
- MD5 597b5fae4abae703148ad9d1498d57c0
- SHA1 52e79f87e3e6d640a41d51607d482787f70bc44a
- SHA512 87a672e056de5f36dc43d3c63c4a8821e0ef3a02cba1b8744f9856ec736908cabef9e0a47cdf6bac4e25f331eb3216858f48f2fe85d880517df4e45c18d8f27d
- SSDEEP 12288:MSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:/vO2xJKRw2kOkxSkW298B
- TLSH T15FF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH