Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 15:57
Behavioral task
behavioral1
Sample
c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe
- Size 560KB
- Sample260528-teaamafs81
- SHA256 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3
- MD5 f72d9848d83ef7b428872316c38c6858
- SHA1 45976bf56cca31c7245662d22bd89edc737e7546
- SHA512 5b5bc5b38a7453fe53bbc8d69fcf0d8d3c5a42686c3820460c0cf7426540901b5c94c07eaaf8da34fe16af2eed0ea44731473134a0c30046cafa119c3f138daa
- SSDEEP 12288:v3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:NVOL4/gPXKCOkx2LFR
- TLSH T1CDC46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1576 d6e6f1e9 - Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 232 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 374 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 1 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 36 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 87 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 290 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 2 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 35 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 94 114.114.114.114 1576 d6e6f1e9 Destination IP 231 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 289 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 319 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 320 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 86 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 103 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 142 114.114.114.114 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Destination IP 143 223.5.5.5 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\d6e6f1e9 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d6e6f1e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d6e6f1e9 -
resource yara_rule behavioral2/memory/1600-0-0x0000000000980000-0x0000000000A0C000-memory.dmp upx behavioral2/files/0x001f00000002b1be-3.dat upx behavioral2/memory/1576-4-0x0000000000BB0000-0x0000000000C3C000-memory.dmp upx behavioral2/memory/1600-18-0x0000000000980000-0x0000000000A0C000-memory.dmp upx behavioral2/memory/1576-19-0x0000000000BB0000-0x0000000000C3C000-memory.dmp upx behavioral2/memory/1576-36-0x0000000000BB0000-0x0000000000C3C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1afb50 d6e6f1e9 File opened for modification C:\Windows\1b6480 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d6e6f1e9 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d6e6f1e9 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d6e6f1e9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d6e6f1e9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d6e6f1e9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d6e6f1e9 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d6e6f1e9 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d6e6f1e9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d6e6f1e9 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d6e6f1e9 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1576 d6e6f1e9 1576 d6e6f1e9 1576 d6e6f1e9 1576 d6e6f1e9 1576 d6e6f1e9 1576 d6e6f1e9 1576 d6e6f1e9 1576 d6e6f1e9 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Token: SeTcbPrivilege 1600 c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe Token: SeDebugPrivilege 1576 d6e6f1e9 Token: SeTcbPrivilege 1576 d6e6f1e9
Processes
-
C:\Users\Admin\AppData\Local\Temp\c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe"C:\Users\Admin\AppData\Local\Temp\c86616272c712246ee2e952585ffd45b02a374aa12d0f97e3d7c7b19a653d0f3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
C:\Windows\Syswow64\d6e6f1e9C:\Windows\Syswow64\d6e6f1e91⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d6e6f1e9
- Size 560KB
- SHA256 ec2d0ee1f207a4be1db14134e458164a8b52eee7457075f93262b862a5c6ba86
- MD5 7d18f5ccce5c438fe8c9399f1d1b1a73
- SHA1 edc230c3b226f16fc884e023544a0fc81b70501d
- SHA512 71e8c389063b4f9561b78cb0001435bf6981dd9fefdce4fe27820484a335ee0fba5d631d78d4a82c5c7da671083ea1337af3f046ee6ff4e08e5860481e112c41
- SSDEEP 12288:N3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:vVOL4/gPXKCOkx2LFR
- TLSH T1FEC46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH