Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 13:17
Behavioral task
behavioral1
Sample
4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe
- Size 768KB
- Sample260507-qjs2raev7w
- SHA256 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517
- MD5 cda843c5571b32b40c1feb2dd1818400
- SHA1 c4f10cd7ea6d3e1112cfcdea2442a5eea9cd6b61
- SHA512 f0b2a1037f14404bcba64f9746e4d1c326fdad8cf643af2fbf58d118295db5aa205265370a03fd6497cb53d44952e9c0b998fad81b9dacdba86f5ae00c6a7d18
- SSDEEP 12288:NkqXUHkUXe39sOkx2LIan5FAQjU/LikGU5rCOTeidT:ajHPOSOkx2LFscU6UQOJdT
- TLSH T154F47D31E241C036D6A74572C6FA4BBBA5247D25431161CBA7C4BA262FB76D2FA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3384 2422fc68 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 97 223.5.5.5 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 155 223.5.5.5 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 1 114.114.114.114 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 29 223.5.5.5 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 46 223.5.5.5 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 95 114.114.114.114 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 154 114.114.114.114 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 2 223.5.5.5 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 28 114.114.114.114 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Destination IP 45 114.114.114.114 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2422fc68 File created C:\Windows\SysWOW64\2422fc68 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 2422fc68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 2422fc68 -
resource yara_rule behavioral2/memory/2716-0-0x0000000000E30000-0x0000000000EB9000-memory.dmp upx behavioral2/files/0x000d000000027002-2.dat upx behavioral2/memory/3384-4-0x00000000001E0000-0x0000000000269000-memory.dmp upx behavioral2/memory/2716-18-0x0000000000E30000-0x0000000000EB9000-memory.dmp upx behavioral2/memory/3384-20-0x00000000001E0000-0x0000000000269000-memory.dmp upx behavioral2/memory/3384-21-0x00000000001E0000-0x0000000000269000-memory.dmp upx behavioral2/memory/2716-38-0x0000000000E30000-0x0000000000EB9000-memory.dmp upx behavioral2/memory/3384-39-0x00000000001E0000-0x0000000000269000-memory.dmp upx behavioral2/memory/2716-40-0x0000000000E30000-0x0000000000EB9000-memory.dmp upx behavioral2/memory/2716-54-0x0000000000E30000-0x0000000000EB9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\39ef70 2422fc68 File opened for modification C:\Windows\2e7fb8 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2422fc68 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2422fc68 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2422fc68 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2422fc68 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2422fc68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2422fc68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2422fc68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2422fc68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2422fc68 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 2422fc68 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3384 2422fc68 3384 2422fc68 3384 2422fc68 3384 2422fc68 3384 2422fc68 3384 2422fc68 3384 2422fc68 3384 2422fc68 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Token: SeTcbPrivilege 2716 4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe Token: SeDebugPrivilege 3384 2422fc68 Token: SeTcbPrivilege 3384 2422fc68
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe"C:\Users\Admin\AppData\Local\Temp\4e9e5e1138eb38ce642e94cd9ca7c5fd9cadcc7423fb26cfc177ee8758f96517.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Windows\Syswow64\2422fc68C:\Windows\Syswow64\2422fc681⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\2422fc68
- Size 768KB
- SHA256 a8dd25c72baa6c1e3721d9ba76d785547a55e29e88fe89942ec833e020d9df20
- MD5 814995a1a1d3b1ee82a2b5b0e3604b85
- SHA1 303482e6647874ead6f2468d770efb2f6ad07ecd
- SHA512 f53b3e8c9ae2b9879771c0592a3558742a3eba8ef856785520b7c2694e5f22e853b27eb0e9a2a5d413279856a77601fd79f5cb7dc90dfbe114d8fce6b5d119d6
- SSDEEP 12288:KqXUHkUXe39sOkx2LIan5FAQjU/LikGU5rCOTeidT:KjHPOSOkx2LFscU6UQOJdT
- TLSH T14DF47D31E241C036D6A74572C6FA4BBBA5247D25431161CBA7C4BA262FB76D2FA3130F
- MD5 SHA1 SHA512 SSDEEP TLSH