Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 19:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe
- Size 2.0MB
- Sample260511-ycbg5ahs41
- SHA256 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3
- MD5 0e8d32217449dedbe60563836803c2bd
- SHA1 5512472d874c80dc701d974bee0ddb0327039bb9
- SHA512 43c45929205a570111028f2c0d599c84c305b2b9b29d791f30d36151c150db7cc38fa492274e6764b735cd461e9491f18c290d79012e56068373148346ee130b
- SSDEEP 49152:jHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:jnKdVkOhCXHHFZMjHfUKkVi
- TLSH T1EDA57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3304 64c0d2db - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 15 223.5.5.5 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe Destination IP 1 114.114.114.114 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe Destination IP 2 223.5.5.5 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe Destination IP 14 114.114.114.114 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 64c0d2db File created C:\Windows\SysWOW64\64c0d2db eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 64c0d2db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 64c0d2db - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3890d0 64c0d2db File opened for modification C:\Windows\227238 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64c0d2db - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 64c0d2db Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 64c0d2db Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 64c0d2db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 64c0d2db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 64c0d2db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 64c0d2db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 64c0d2db Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 64c0d2db Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 64c0d2db - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 3304 64c0d2db 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe Token: SeTcbPrivilege 2012 eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe Token: SeDebugPrivilege 3304 64c0d2db Token: SeTcbPrivilege 3304 64c0d2db
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe"C:\Users\Admin\AppData\Local\Temp\eb6309f3b9e301330e21149442bb983bf4e5cf6f52708b0b154532201648d5a3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
C:\Windows\Syswow64\64c0d2dbC:\Windows\Syswow64\64c0d2db1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\3890d0
- Size 916B
- SHA256 c519851323c94b93472a54839a787f1da0dbedff7841387e0d355feab4f258c3
- MD5 bf15bc7f1418cdaf435a865e69cbde08
- SHA1 1ac71d2e6d3bd388547f675a5389af6714e390e8
- SHA512 9f0b3372c70694e0245294ff6c5dc86d133d4d8a2d23f81fc4c85c064d49069ead54d0a69dc0b498c163accb3f8c4e094d9c74d3cfafba9e3a7f3a093a2e0f74
- TLSH T108112B79239A1F920EBF4D7D569B80C0B016660681BB246837C7231F2137E354E0BAEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\64c0d2db
- Size 2.0MB
- SHA256 c617484bc5713c6879a47c56f7b7d71333b9a524d1c93b03bece4b01c3216ffe
- MD5 a820fd017edf3ee17f16656411244600
- SHA1 861ddf761c5c15c3a9aaca7469fbe31ecacfebed
- SHA512 fd46f1fb900141ec39f78d792bb63c47ec70b2adc0d0a282be30bfd62fd9700e8de7484020d2e79208c003bb69759f2cad0edf4f79a53d2e511c185b32a20f10
- SSDEEP 49152:fHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:fnKdVkOhCXHHFZMjHfUKkVi
- TLSH T153A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH