Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 04:28
Behavioral task
behavioral1
Sample
7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe
- Size 560KB
- Sample260505-e33vhsgv2t
- SHA256 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa
- MD5 2769406a233d713263c0373d7b7b1eaa
- SHA1 442f980bfeec48b6b0d9069235c9a7adbd9cf826
- SHA512 9f79842669b1442c8812e8c2448c8c698f37e48b6a581d1efe05cb4288311394a1e7e344b9577bce89e8c9e800fb8512190b716aae52e6317a0e68bb20528fa1
- SSDEEP 6144:ZWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:ZkCO2zVPX7vf1LKlIsOkxHy
- TLSH T1EBC47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D00B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4164 a9352048 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 158 223.5.5.5 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Destination IP 3 114.114.114.114 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Destination IP 4 223.5.5.5 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Destination IP 48 114.114.114.114 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Destination IP 51 223.5.5.5 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Destination IP 157 114.114.114.114 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a9352048 File created C:\Windows\SysWOW64\a9352048 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a9352048 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a9352048 -
resource yara_rule behavioral1/memory/3452-0-0x0000000000DD0000-0x0000000000E5C000-memory.dmp upx behavioral1/files/0x000800000001e6c8-2.dat upx behavioral1/memory/4164-3-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral1/memory/3452-18-0x0000000000DD0000-0x0000000000E5C000-memory.dmp upx behavioral1/memory/4164-19-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx behavioral1/memory/4164-27-0x0000000000E70000-0x0000000000EFC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\474a08 a9352048 File opened for modification C:\Windows\3b1978 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9352048 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a9352048 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a9352048 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a9352048 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a9352048 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a9352048 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a9352048 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a9352048 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a9352048 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a9352048 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4164 a9352048 4164 a9352048 4164 a9352048 4164 a9352048 4164 a9352048 4164 a9352048 4164 a9352048 4164 a9352048 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Token: SeTcbPrivilege 3452 7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe Token: SeDebugPrivilege 4164 a9352048 Token: SeTcbPrivilege 4164 a9352048
Processes
-
C:\Users\Admin\AppData\Local\Temp\7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe"C:\Users\Admin\AppData\Local\Temp\7494d733a2a81f6d09c743a7de5e389ba2e9ca45aaf1b3ea98bec93b440545fa.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
C:\Windows\Syswow64\a9352048C:\Windows\Syswow64\a93520481⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a9352048
- Size 560KB
- SHA256 84dd26def369e2441d8574ef85b6b77cea04dba3d11cb8b43fcb9c0947f66ea7
- MD5 16e06fb49eaa86593c8fa67788f564cb
- SHA1 9d272301f6f8b28694563594c4622c3f46d558a0
- SHA512 c5cd262a9466b1ccafbb18a7dc8721ad52ab552fc5cbe3d660c9d2096e431c8071400c8afea1d11db8637003c668607ab4962d41449801bf100e2282c3021b83
- SSDEEP 6144:nWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:nkCO2zVPX7vf1LKlIsOkxHy
- TLSH T12FC47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D00B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH