Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 08:04
Behavioral task
behavioral1
Sample
8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe
- Size 560KB
- Sample260529-jyrnxae14m
- SHA256 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7
- MD5 057cd703194e05d71d4dbca89dd478d2
- SHA1 98b779597f9b2e4e187976f0ef5ec57e3ee070bb
- SHA512 c24366b9778f74d8ae819c99e36134aadfa94f915f6442753fed65d79974861097d66f03bccfece3a749b85cc8d5aa9f785c84435841adddc3f1652a56158cf4
- SSDEEP 6144:66UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:6O7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T1F8C46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4044 e2664b4b - Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 94 114.114.114.114 4044 e2664b4b Destination IP 104 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 142 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 143 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 289 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 373 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 1 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 36 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 231 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 232 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 319 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 2 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 35 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 290 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 320 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 85 114.114.114.114 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Destination IP 87 223.5.5.5 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e2664b4b File created C:\Windows\SysWOW64\e2664b4b 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e2664b4b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e2664b4b -
resource yara_rule behavioral2/memory/4988-0-0x0000000000410000-0x000000000049C000-memory.dmp upx behavioral2/memory/4044-3-0x0000000000220000-0x00000000002AC000-memory.dmp upx behavioral2/files/0x000a00000000d3c3-2.dat upx behavioral2/memory/4988-18-0x0000000000410000-0x000000000049C000-memory.dmp upx behavioral2/memory/4044-19-0x0000000000220000-0x00000000002AC000-memory.dmp upx behavioral2/memory/4044-36-0x0000000000220000-0x00000000002AC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\453c18 e2664b4b File opened for modification C:\Windows\556578 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2664b4b - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e2664b4b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e2664b4b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e2664b4b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e2664b4b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e2664b4b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e2664b4b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e2664b4b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e2664b4b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e2664b4b - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4044 e2664b4b 4044 e2664b4b 4044 e2664b4b 4044 e2664b4b 4044 e2664b4b 4044 e2664b4b 4044 e2664b4b 4044 e2664b4b 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Token: SeTcbPrivilege 4988 8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe Token: SeDebugPrivilege 4044 e2664b4b Token: SeTcbPrivilege 4044 e2664b4b
Processes
-
C:\Users\Admin\AppData\Local\Temp\8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe"C:\Users\Admin\AppData\Local\Temp\8adaef6a7e6bff1583300f7025f19e6dabda6064769f9709758222f53cbc56d7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
C:\Windows\Syswow64\e2664b4bC:\Windows\Syswow64\e2664b4b1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e2664b4b
- Size 560KB
- SHA256 33eb3cc02be77f9b0d80e9d8bd9e8fd21c79860c10d76a36ab4c9d9e6b648e16
- MD5 b299e833336eab90e06ce3585b15da42
- SHA1 345dc2b95cc683c30bcdfe90400c037f520e9b1e
- SHA512 f1879ae893ed1dd41c9f8cb33cada29bc3fa24b9c8bc32c75e0bfffabcdd172cf06f8899693e066629e37dc9e91e11c25803e317006b07bbef6673a67ca6a1c2
- SSDEEP 6144:86UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:8O7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T106C46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH