Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 10:26
Behavioral task
behavioral1
Sample
b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe
- Size 3.0MB
- Sample260528-mgj5aaev61
- SHA256 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f
- MD5 8e09aa6e918c166fd2d88f845db11192
- SHA1 09a1d879e20faacb2cef9d958accfe7332c8e819
- SHA512 3249a7a80231191be41b9e0a65e6556b2dee4c548b143fff7cde417e4b412c26d6fc627ed5364437064e1c36989ae758b497d16bf836792083702904e61c5fbd
- SSDEEP 49152:qA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:V/whnLrHp/qKm2/Sb/
- TLSH T175E55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1608 d440e580 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe Destination IP 2 223.5.5.5 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe Destination IP 9 114.114.114.114 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe Destination IP 10 223.5.5.5 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\d440e580 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d440e580 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d440e580 -
resource yara_rule behavioral2/memory/4380-0-0x0000000000730000-0x0000000000A35000-memory.dmp upx behavioral2/files/0x002100000002b2e7-2.dat upx behavioral2/memory/1608-4-0x00000000006B0000-0x00000000009B5000-memory.dmp upx behavioral2/memory/4380-5-0x0000000000730000-0x0000000000A35000-memory.dmp upx behavioral2/memory/1608-6-0x00000000006B0000-0x00000000009B5000-memory.dmp upx behavioral2/memory/1608-21-0x00000000006B0000-0x00000000009B5000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d440e580 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d440e580 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d440e580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d440e580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d440e580 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d440e580 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d440e580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d440e580 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d440e580 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d440e580 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1608 d440e580 1608 d440e580 1608 d440e580 1608 d440e580 1608 d440e580 1608 d440e580 1608 d440e580 1608 d440e580 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe Token: SeTcbPrivilege 4380 b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe Token: SeDebugPrivilege 1608 d440e580 Token: SeTcbPrivilege 1608 d440e580
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe"C:\Users\Admin\AppData\Local\Temp\b3b13cd0fd2fa937161ca78950108e8128c31edc5c80d572099d73b8a4945f1f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
C:\Windows\Syswow64\d440e580C:\Windows\Syswow64\d440e5801⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d440e580
- Size 3.0MB
- SHA256 79f12b441538b76f8f4cd257dbd8c2e2749989fcb288b8a90321d0b9a14624f4
- MD5 5281681e8cfe1806bab799ba03e00007
- SHA1 acf8dd2f50433d2c6bd579e7bc6001be2cd676bd
- SHA512 334d2be73bea5ec3ec20d3dc29e8477aa1fb12ad828872bd93d4ebd2ba7a076cf5484d14ca40c1326bfe33f66bdeac7ea9fb509d044fe66cf788178d435d1211
- SSDEEP 49152:XA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:Q/whnLrHp/qKm2/Sb/
- TLSH T13DE55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH