Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe
- Size 3.3MB
- Sample260511-yre4vsds2k
- SHA256 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330
- MD5 863f659287af2f431e14cb7e0daf458b
- SHA1 cccd6ae31205be5a711a0c54fc0a986d9b059d57
- SHA512 ba6df0a37390c65a9b3a6da54e771a3e499c5f7306987a4d996ba798f27ec8b1a69a01464d349be8cd9c5629e0859049097719d66381c475e02a1e075b65f59c
- SSDEEP 49152:qHHKO29Qr5QZuTtS0rQMYOQ+q8CEOTG4QwTGHQS9KFd:qnKdwWsM0r1QnRK4xKH90Fd
- TLSH T161F59F12F350C035C4AB467589BA47AE9679BD210B2157CBA7C07BAE1FB33C16E3570A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1032 b2486156 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 36 223.5.5.5 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 46 114.114.114.114 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 47 223.5.5.5 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 110 114.114.114.114 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 111 223.5.5.5 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 1 114.114.114.114 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 2 223.5.5.5 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 35 114.114.114.114 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 169 114.114.114.114 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Destination IP 170 223.5.5.5 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b2486156 File created C:\Windows\SysWOW64\b2486156 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b2486156 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b2486156 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\11ab10 b2486156 File opened for modification C:\Windows\5e17f0 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2486156 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b2486156 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b2486156 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b2486156 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b2486156 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b2486156 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b2486156 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b2486156 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b2486156 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b2486156 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1032 b2486156 1032 b2486156 1032 b2486156 1032 b2486156 1032 b2486156 1032 b2486156 1032 b2486156 1032 b2486156 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Token: SeTcbPrivilege 5496 6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe Token: SeDebugPrivilege 1032 b2486156 Token: SeTcbPrivilege 1032 b2486156
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe"C:\Users\Admin\AppData\Local\Temp\6f3992d543de8526419562da08c0001aacc4311bce1b02dde4733a58fc55f330.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5496
-
C:\Windows\Syswow64\b2486156C:\Windows\Syswow64\b24861561⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b2486156
- Size 3.3MB
- SHA256 bc599c5d7d37ebe645fa72b1c6d9a4da663efef6b39a46fc84b6c00d2200fffa
- MD5 448b4afdeb7c6696bd061e25ce814308
- SHA1 17b1bb4ea4dd0b9bc018dde01fba29d79c68e1bd
- SHA512 8860750e2355da2d267c075ae469f76ee2fec5e10dc6162b8c97f1e26367a819a56be0968108274e3c1eb2ab23a0e4cb4b29b7b118fa367cd832a3fdd266f574
- SSDEEP 49152:mHHKO29Qr5QZuTtS0rQMYOQ+q8CEOTG4QwTGHQS9KFd:mnKdwWsM0r1QnRK4xKH90Fd
- TLSH T1E9F59F12F350C035C4AB467589BA47AE9679BD210B2157CBA7C07BAE1FB33C16E3570A
- MD5 SHA1 SHA512 SSDEEP TLSH