Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 18:06
Behavioral task
behavioral1
Sample
99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe
- Size 548KB
- Sample260504-wp71radx8p
- SHA256 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6
- MD5 ec1ae874bd459a7b57e8dd4f0baea0a3
- SHA1 cbecd2b6cdef0dc8e434a1a79ce6cd07115f6de1
- SHA512 ca918ea0c7052f8b9012b1704ad791b010c55470080a3c5cae55f05ed20eda98a3b94511083648cbd31143d1e88d21b4ce55da3fb81ba8b9cf9895ebf324af2b
- SSDEEP 12288:IkbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:JbOgbEqy9RKejHPOwOkx2LF
- TLSH T15BC4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1908 f3c30b20 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe Destination IP 7 114.114.114.114 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe Destination IP 8 223.5.5.5 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe Destination IP 1 114.114.114.114 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\f3c30b20 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f3c30b20 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f3c30b20 -
resource yara_rule behavioral2/memory/4176-0-0x0000000000EA0000-0x0000000000F29000-memory.dmp upx behavioral2/files/0x001e00000002b23f-2.dat upx behavioral2/memory/1908-3-0x0000000000280000-0x0000000000309000-memory.dmp upx behavioral2/memory/4176-17-0x0000000000EA0000-0x0000000000F29000-memory.dmp upx behavioral2/memory/1908-19-0x0000000000280000-0x0000000000309000-memory.dmp upx behavioral2/memory/4176-36-0x0000000000EA0000-0x0000000000F29000-memory.dmp upx behavioral2/memory/1908-37-0x0000000000280000-0x0000000000309000-memory.dmp upx behavioral2/memory/4176-46-0x0000000000EA0000-0x0000000000F29000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\477ea0 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe File opened for modification C:\Windows\20aa68 f3c30b20 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3c30b20 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f3c30b20 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f3c30b20 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f3c30b20 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f3c30b20 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f3c30b20 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f3c30b20 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f3c30b20 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f3c30b20 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f3c30b20 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 1908 f3c30b20 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe Token: SeTcbPrivilege 4176 99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe Token: SeDebugPrivilege 1908 f3c30b20 Token: SeTcbPrivilege 1908 f3c30b20
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe"C:\Users\Admin\AppData\Local\Temp\99a47d06231238501a1b69c7192723a4329b888fc378dc2da8fbbd71c332ebb6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
C:\Windows\Syswow64\f3c30b20C:\Windows\Syswow64\f3c30b201⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\f3c30b20
- Size 548KB
- SHA256 746950fe1147ee547819fbcfead473a6b85d37881c40ab642dbb5af8f800e8af
- MD5 db267487c94e4a1799b0a1a66cf78508
- SHA1 3183c471a317b74584c5965ad9afa83913875e62
- SHA512 f501cd6e44acab2a536054738665373cba216146cdb786824fc327c9eb56cee714f0fff8250ad836a9f15c09cd8303264dc2643f273d5c9a49e4fbc0706550fd
- SSDEEP 12288:pkbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:mbOgbEqy9RKejHPOwOkx2LF
- TLSH T164C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH