Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 22:21
Behavioral task
behavioral1
Sample
65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe
- Size 1.2MB
- Sample260508-19yp2ae14x
- SHA256 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf
- MD5 5b97ada541d7608ce0074495d8bc2cc9
- SHA1 325c707fd6ac89410fce99de8ea3fa6f0c61edde
- SHA512 d185615605d938545e881a31db6f2d590efa53c25bbeddf85fb5ca306833ed2b4259c2f2094a5245ba2a093be3a5dc350d12a533bb41ccfbac0194836bc32112
- SSDEEP 24576:9vO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:9HHKe2WQX5QZuTtS0rQS
- TLSH T15A458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4828 65569f5c - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 30 223.5.5.5 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe Destination IP 3 114.114.114.114 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe Destination IP 6 223.5.5.5 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe Destination IP 29 114.114.114.114 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 65569f5c File created C:\Windows\SysWOW64\65569f5c 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 65569f5c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 65569f5c -
resource yara_rule behavioral1/memory/1564-0-0x0000000000E50000-0x0000000000EDC000-memory.dmp upx behavioral1/files/0x001e0000000242ff-3.dat upx behavioral1/memory/4828-4-0x0000000000280000-0x000000000030C000-memory.dmp upx behavioral1/memory/1564-20-0x0000000000E50000-0x0000000000EDC000-memory.dmp upx behavioral1/memory/4828-21-0x0000000000280000-0x000000000030C000-memory.dmp upx behavioral1/memory/4828-26-0x0000000000280000-0x000000000030C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1ac6b8 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe File opened for modification C:\Windows\52a838 65569f5c - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65569f5c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 65569f5c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 65569f5c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 65569f5c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 65569f5c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 65569f5c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 65569f5c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 65569f5c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 65569f5c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 65569f5c - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 4828 65569f5c 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe Token: SeTcbPrivilege 1564 65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe Token: SeDebugPrivilege 4828 65569f5c Token: SeTcbPrivilege 4828 65569f5c
Processes
-
C:\Users\Admin\AppData\Local\Temp\65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe"C:\Users\Admin\AppData\Local\Temp\65fa0110d3dc93b0ef08a31d906a7ae24afec6fdc3d39303a12af143a2a75bdf.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
C:\Windows\Syswow64\65569f5cC:\Windows\Syswow64\65569f5c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\52a838
- Size 506B
- SHA256 5b13814b8aaf60681bb7800521fbf1f9d46e8dd1f82c0a8ecb382a7d505b5bf5
- MD5 07d08528d8d7cea938f97c113ce18aaf
- SHA1 177fdf2ed44be3af4063f3abaaeffe60ed75a998
- SHA512 8050045717c6a6b55c9282199de4a21af84e06a520ee12d63e8880da5d41127ca7ae837a1fc5d473dde4751793f65d8e741d426a232af24b084a11b42479029e
- TLSH T163F005FFFC26B35108A63673AD071817257F733DE096B2D7ED83734D14522A25802A11
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\65569f5c
- Size 1.2MB
- SHA256 9fa4433d4bd10ff7f920b73e1eb610ef009e4a47310e150aeb74e54e025c77db
- MD5 238d4417cbb9e7958c25f0d04cae6f5f
- SHA1 ef87a3cc9eb0d439a2a9ca9871265d80fbbcacb5
- SHA512 68dfeabb0abd1459086f0887bb967c7c64e689191c996e9be5e49c450dd6e9292e06e00dad1410de26ac05d34fa47b9f9f6ec1e11498a738e7b1a6e875c474ee
- SSDEEP 24576:mvO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:mHHKe2WQX5QZuTtS0rQS
- TLSH T13A458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH