Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/05/2026, 22:18
Behavioral task
behavioral1
Sample
745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe
- Size 640KB
- Sample260508-171fvae12t
- SHA256 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb
- MD5 8b592bf9411942c1fd42a65e2cff390c
- SHA1 af57eafee49215a2abcdccff610eaa55045089d5
- SHA512 26e3f69e3543e0780fbd93c35a691f888ddcebce9a8eb77daaad65fbf09f9d483288e393215e8408a65a1e7f5cb36e61873f29476936c615a468e679e68045a6
- SSDEEP 6144:vcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:vSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T102D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1908 42b023e0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 5 114.114.114.114 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe Destination IP 6 223.5.5.5 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe Destination IP 1 114.114.114.114 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe Destination IP 2 223.5.5.5 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 42b023e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 42b023e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 42b023e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 42b023e0 File created C:\Windows\SysWOW64\42b023e0 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe -
resource yara_rule behavioral2/memory/2776-0-0x0000000000CC0000-0x0000000000D4C000-memory.dmp upx behavioral2/files/0x001e00000002b23f-2.dat upx behavioral2/memory/1908-3-0x0000000000C10000-0x0000000000C9C000-memory.dmp upx behavioral2/memory/2776-17-0x0000000000CC0000-0x0000000000D4C000-memory.dmp upx behavioral2/memory/1908-18-0x0000000000C10000-0x0000000000C9C000-memory.dmp upx behavioral2/memory/1908-23-0x0000000000C10000-0x0000000000C9C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\20aa68 42b023e0 File opened for modification C:\Windows\2f86b0 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42b023e0 - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 42b023e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 42b023e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 42b023e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 42b023e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 42b023e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 42b023e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 42b023e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 42b023e0 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 1908 42b023e0 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe Token: SeTcbPrivilege 2776 745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe Token: SeDebugPrivilege 1908 42b023e0 Token: SeTcbPrivilege 1908 42b023e0
Processes
-
C:\Users\Admin\AppData\Local\Temp\745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe"C:\Users\Admin\AppData\Local\Temp\745a9bd7a690bf5437fc367cfff310ca6ce019c7d882ceda818cc7d2c85afeeb.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Windows\Syswow64\42b023e0C:\Windows\Syswow64\42b023e01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\20aa68
- Size 1KB
- SHA256 25f9cc9c9db49ec08ef9580ccbf5a10b2426765d794c04d0c480d0da3fd3839f
- MD5 3818c7e2520d9f7565d8d9a490d851b1
- SHA1 11fffd425da005cd608b2879afd116b7dab95fdc
- SHA512 7257818ae4ef66feaac0b274503ea38692cfd478d2a703da2d051438f5cee6d3aa2aa1b80961fca62536280c4f7723f0c6f5c1827d48703118f6c3fcccb9b1ff
- TLSH T18821DC31301F3D582E4CAE75C491064840AF630D9B29B178F8E6AFA30293574AD4B677
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\42b023e0
- Size 640KB
- SHA256 dcfa70909479c14aa524095d804d544ac87fd3e9610f086759bf561e82618adf
- MD5 cf880e653b2cb563041e2023ba5f2145
- SHA1 0864ecbd25078bffc2c946b676aa4e29ab1b0ccd
- SHA512 30eaca67eaac7741ce81f750ca9b71c4665efbc55cdd0f3c52e7fec249a61da82bf1704f9bd86c9a77095eeca846eb176dcada09704219353a24cc0c0ceb3b06
- SSDEEP 6144:JcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:JSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T1EFD45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH