Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 08:28
Behavioral task
behavioral1
Sample
8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe
- Size 384KB
- Sample260504-kdfxcaey4x
- SHA256 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785
- MD5 5a762d8e723922d4f9aaebc51b0f2cfe
- SHA1 8954f065036fb15590d68303c124969d24383f8c
- SHA512 30ea2e379f865cc2f16e559bf7fab3091d10253c0ada32c6690d5ac89e54bc8c3d61815f4d4ec475530ff65d0dcb56d4a949641887a56bec22917f6d0c32bf79
- SSDEEP 6144:Ml51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOan5R2:wqXUHkUXe39sOkx2LIan5g
- TLSH T18F849D22F3518036C1A78676C7B70F9AF7A5BD18831253CB5340B56A2FB32D2AE35719
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4384 60fa6154 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 40 223.5.5.5 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe Destination IP 3 114.114.114.114 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe Destination IP 4 223.5.5.5 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe Destination IP 39 114.114.114.114 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 60fa6154 File created C:\Windows\SysWOW64\60fa6154 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 60fa6154 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 60fa6154 -
resource yara_rule behavioral1/memory/4656-0-0x0000000000510000-0x0000000000599000-memory.dmp upx behavioral1/files/0x000a000000021655-3.dat upx behavioral1/memory/4384-4-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral1/memory/4656-15-0x0000000000510000-0x0000000000599000-memory.dmp upx behavioral1/memory/4384-17-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral1/memory/4656-32-0x0000000000510000-0x0000000000599000-memory.dmp upx behavioral1/memory/4384-33-0x0000000000BC0000-0x0000000000C49000-memory.dmp upx behavioral1/memory/4656-43-0x0000000000510000-0x0000000000599000-memory.dmp upx behavioral1/memory/4656-50-0x0000000000510000-0x0000000000599000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4b0e40 60fa6154 File opened for modification C:\Windows\4fb660 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60fa6154 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 60fa6154 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 60fa6154 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 60fa6154 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 60fa6154 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 60fa6154 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 60fa6154 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 60fa6154 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 60fa6154 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 60fa6154 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4384 60fa6154 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe Token: SeTcbPrivilege 4656 8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe Token: SeDebugPrivilege 4384 60fa6154 Token: SeTcbPrivilege 4384 60fa6154
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe"C:\Users\Admin\AppData\Local\Temp\8b6b9ca646905bfd3cb1075c923341bc9c8addd67dc0ee1ed16d29d6e96fb785.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
C:\Windows\Syswow64\60fa6154C:\Windows\Syswow64\60fa61541⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\60fa6154
- Size 384KB
- SHA256 adf97b80f078a4a5e0b0c9e95907dce656174a1afa7b877c5278327b4e3516f1
- MD5 22bf51b8b35c97a2a9b9b8fe27a60771
- SHA1 d762572647b79f5bfee4e51689ead1860fe987d2
- SHA512 8499005c99fee325cad883c05b187f062d1e4a790e2e9abe2f623653356080b0fec7d5955b0c3bfaa364becaf5203432eb65ef852de5f1ac5fb943b14f0c08c6
- SSDEEP 6144:al51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOan5R2:CqXUHkUXe39sOkx2LIan5g
- TLSH T123849D22F3518036C1978672C7B70F9AF7A5BD18831253CB5340B56A2FB32D2AE35719
- MD5 SHA1 SHA512 SSDEEP TLSH