f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
Size 576KB
Sample260511-yb993acy4m
SHA256 f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5
MD5 0aa09636c9aba9094d314d5949d38a8d
SHA1 4897f49b7ef0a53bdced91dd7d74afc701a97b2b
SHA512 1e84491d4f3a6d12f4a29e7b3f66adee0c8a8ea0c88b4b412f7bd993e0e0b68aafd14d864f64b2babb3f771773ea0d9ba4159d673b0297564c9c30234aff820b
SSDEEP 12288:aqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:ajHPOSOkx2LFscUQPK
TLSH
T106C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2064	2b4d4b95

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	114.114.114.114	4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
Destination IP	2	223.5.5.5	4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
Destination IP	24	114.114.114.114	4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
Destination IP	25	223.5.5.5	4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	2b4d4b95
File created	C:\Windows\SysWOW64\2b4d4b95	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	2b4d4b95
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	2b4d4b95

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-0-0x0000000000420000-0x00000000004A9000-memory.dmp	upx
behavioral2/files/0x001800000002ad5a-2.dat	upx
behavioral2/memory/2064-4-0x0000000000100000-0x0000000000189000-memory.dmp	upx
behavioral2/memory/4836-18-0x0000000000420000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/2064-20-0x0000000000100000-0x0000000000189000-memory.dmp	upx
behavioral2/memory/4836-38-0x0000000000420000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/2064-40-0x0000000000100000-0x0000000000189000-memory.dmp	upx
behavioral2/memory/4836-46-0x0000000000420000-0x00000000004A9000-memory.dmp	upx
behavioral2/memory/2064-48-0x0000000000100000-0x0000000000189000-memory.dmp	upx
behavioral2/memory/4836-58-0x0000000000420000-0x00000000004A9000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\235620	2b4d4b95
File opened for modification	C:\Windows\52cb48	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b4d4b95

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	2b4d4b95
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	2b4d4b95
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2b4d4b95
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2b4d4b95
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2b4d4b95
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2b4d4b95
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2b4d4b95
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	2b4d4b95
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	2b4d4b95

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2064	2b4d4b95
2064	2b4d4b95
2064	2b4d4b95
2064	2b4d4b95
2064	2b4d4b95
2064	2b4d4b95
2064	2b4d4b95
2064	2b4d4b95
4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
Token: SeTcbPrivilege	4836	f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
Token: SeDebugPrivilege	2064	2b4d4b95
Token: SeTcbPrivilege	2064	2b4d4b95

C:\Users\Admin\AppData\Local\Temp\f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe
"C:\Users\Admin\AppData\Local\Temp\f250df1164c777b71d8ac74fb345d0f883b655bfac484e5fbcc44d0ad817fdd5.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\Syswow64\2b4d4b95
C:\Windows\Syswow64\2b4d4b95
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2b4d4b95

Path C:\Windows\SysWOW64\2b4d4b95
Size 576KB
SHA256 9a858003b9294af85fef0098983ba0834a54eb7b3a45065bc0c2dfb0b44d56b8
MD5 68a705999fc24e738af3e61f82af6ee4
SHA1 e11a0ff3358ec2c64c5ddfb1f03f4951e76bc51c
SHA512 5ed3348b5f66b60538c92caa7fd943033acda641f319032e8f202d1ca024be2f9bb96cd4eaee0387cac5eeb85c501e73d8821bfa64a5a1be328ef5ed900b885c
SSDEEP 12288:zqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:zjHPOSOkx2LFscUQPK
TLSH
T1B1C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-4-0x0000000000100000-0x0000000000189000-memory.dmp

Download

memory/2064-20-0x0000000000100000-0x0000000000189000-memory.dmp

Download

memory/2064-21-0x0000000002480000-0x0000000002502000-memory.dmp

Download

memory/2064-40-0x0000000000100000-0x0000000000189000-memory.dmp

Download

memory/2064-48-0x0000000000100000-0x0000000000189000-memory.dmp

Download

memory/4836-0-0x0000000000420000-0x00000000004A9000-memory.dmp

Download

memory/4836-18-0x0000000000420000-0x00000000004A9000-memory.dmp

Download

memory/4836-38-0x0000000000420000-0x00000000004A9000-memory.dmp

Download

memory/4836-39-0x00000000032F0000-0x0000000003372000-memory.dmp

Download

memory/4836-46-0x0000000000420000-0x00000000004A9000-memory.dmp

Download

memory/4836-58-0x0000000000420000-0x00000000004A9000-memory.dmp

Download