Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 03:49
Behavioral task
behavioral1
Sample
d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe
- Size 2.9MB
- Sample260529-edb1hact2l
- SHA256 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9
- MD5 369ca4bb18ad14821cc599df30e325f8
- SHA1 5ab0ac857c59a7ab3f3eb2cc9b4e8c43132b33fb
- SHA512 86c6c247f00189510a262347ac68a606bbd6e5cb6a5d0a7089f1fb02b422526d9317903000a9e27008a01479f0051c1b98116332f8c4ef453574ae45dcd3d063
- SSDEEP 49152:mHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:mnKGEkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T147D59E31B6818036D1B7467186FA47BBA5257C211721A5CFB3C47B2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3404 a439454 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe Destination IP 4 223.5.5.5 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe Destination IP 50 114.114.114.114 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe Destination IP 51 223.5.5.5 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C a439454 File created C:\Windows\SysWOW64\a439454 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a439454 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a439454 -
resource yara_rule behavioral1/memory/3116-0-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral1/files/0x0013000000024353-2.dat upx behavioral1/memory/3404-4-0x0000000000240000-0x00000000002CC000-memory.dmp upx behavioral1/memory/3116-13-0x0000000000610000-0x000000000069C000-memory.dmp upx behavioral1/memory/3404-14-0x0000000000240000-0x00000000002CC000-memory.dmp upx behavioral1/memory/3404-26-0x0000000000240000-0x00000000002CC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3558d8 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe File opened for modification C:\Windows\3a4718 a439454 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a439454 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a439454 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a439454 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a439454 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a439454 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a439454 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a439454 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a439454 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a439454 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a439454 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3404 a439454 3404 a439454 3404 a439454 3404 a439454 3404 a439454 3404 a439454 3404 a439454 3404 a439454 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe Token: SeTcbPrivilege 3116 d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe Token: SeDebugPrivilege 3404 a439454 Token: SeTcbPrivilege 3404 a439454
Processes
-
C:\Users\Admin\AppData\Local\Temp\d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe"C:\Users\Admin\AppData\Local\Temp\d755c167c19a35f53fd0422b57c7ee458ba4ceee6c21447f6b19bc22afd09ea9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
C:\Windows\Syswow64\a439454C:\Windows\Syswow64\a4394541⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a439454
- Size 2.9MB
- SHA256 0500f92d53a7f753ea3a10aebd1deb0ecc3cbe4c0755c46730d12c510b9b8f7f
- MD5 5b7ef9ad5894bf95330c6f5e4d32c6a8
- SHA1 b2fd729857c21bac74f978c91a2efa8034068ed8
- SHA512 320e6ba21563e19c726ff7e25b3665bb48b20ff0385ca3b26b47540af350a482b3e606df1b73a08e4b7fa77d9f679b2dc9faeafbc2296f445cf883d8e9bdf15c
- SSDEEP 49152:CHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:CnKGEkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T190D59E31B6818036D1B7467186FA47BBA5257C211721A5CFB3C47B2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH