Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe
- Size 2.0MB
- Sample260511-lrcmhset8t
- SHA256 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107
- MD5 c59263a7eee8276e80a00d8c4ce92ee0
- SHA1 cb1a6737d5522de8d7646fa04370248f56aa41cc
- SHA512 f7ad67739adbba5e42cb255d42a3a966c7eb17ba48b41a70d1a6a52451c02168e0d84f16b3a66cec952cba1406176914bcdc00361b82e7d6ec65615753abc607
- SSDEEP 49152:qHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:qnKdVkOhCXHHFZMjHfUKkVi
- TLSH T1BDA57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1440 8b7cd3a0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 10 223.5.5.5 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe Destination IP 1 114.114.114.114 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe Destination IP 2 223.5.5.5 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe Destination IP 9 114.114.114.114 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 8b7cd3a0 File created C:\Windows\SysWOW64\8b7cd3a0 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8b7cd3a0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 8b7cd3a0 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\18a740 8b7cd3a0 File opened for modification C:\Windows\9a7e8 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b7cd3a0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8b7cd3a0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8b7cd3a0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8b7cd3a0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8b7cd3a0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8b7cd3a0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8b7cd3a0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8b7cd3a0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8b7cd3a0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8b7cd3a0 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1440 8b7cd3a0 1440 8b7cd3a0 1440 8b7cd3a0 1440 8b7cd3a0 1440 8b7cd3a0 1440 8b7cd3a0 1440 8b7cd3a0 1440 8b7cd3a0 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe Token: SeTcbPrivilege 564 0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe Token: SeDebugPrivilege 1440 8b7cd3a0 Token: SeTcbPrivilege 1440 8b7cd3a0
Processes
-
C:\Users\Admin\AppData\Local\Temp\0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe"C:\Users\Admin\AppData\Local\Temp\0185701f613c5db29689180d54d7fa847463d8f76b4a26991ea59868a7294107.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564
-
C:\Windows\Syswow64\8b7cd3a0C:\Windows\Syswow64\8b7cd3a01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\8b7cd3a0
- Size 2.0MB
- SHA256 cb2ecd60eec1b80ed1dc3d17c32d27e9f945311d80a248bc1a0515c651a72c66
- MD5 dfcf0d91112afa0c05685c61316ad85b
- SHA1 2ef953adb68e29ecfe1e473ae37171c007021642
- SHA512 e3abe39ad685193ab501e8fe60467918513e444cf01f66f865b4208b15b4b11c75a4ed79511737ed1bb4aaf798222e661b3038bd370b174f97a6c4f450af68cd
- SSDEEP 49152:JHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:JnKdVkOhCXHHFZMjHfUKkVi
- TLSH T186A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH