Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 22:33
Behavioral task
behavioral1
Sample
caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe
- Size 618KB
- Sample260709-2gp3vsbw4v
- SHA256 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e
- MD5 29e45f34d6bf22e43868f0339708f332
- SHA1 4cff5ea171156cf40c24db321862533c70fc3adc
- SHA512 b9011a66771c39ce234570ae02ba398c53a543a57004941bfd0bdb665198b29eb3dee96595ee452551d74905e967ed343f1a06f35c3cee2b95cfc9b5b0756a7d
- SSDEEP 12288:nqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:njHPOSOkx2LFscUQPxW
- TLSH T14AD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4800 e743667a - Unexpected DNS network traffic destination 14 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 54 114.114.114.114 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 55 223.5.5.5 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 89 223.5.5.5 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 161 114.114.114.114 4800 e743667a Destination IP 169 223.5.5.5 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 244 114.114.114.114 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 245 223.5.5.5 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 307 114.114.114.114 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 3 114.114.114.114 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 5 223.5.5.5 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 87 114.114.114.114 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 162 114.114.114.114 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 163 223.5.5.5 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Destination IP 308 223.5.5.5 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\e743667a caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e743667a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e743667a -
resource yara_rule behavioral1/memory/888-0-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral1/files/0x000400000001dbe7-2.dat upx behavioral1/memory/4800-4-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral1/memory/888-18-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral1/memory/4800-20-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral1/memory/4800-21-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral1/memory/4800-25-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral1/memory/888-38-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral1/memory/4800-39-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral1/memory/888-42-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral1/memory/4800-47-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral1/memory/4800-48-0x0000000000E50000-0x0000000000ED9000-memory.dmp upx behavioral1/memory/888-53-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral1/memory/888-55-0x0000000000860000-0x00000000008E9000-memory.dmp upx behavioral1/memory/888-56-0x0000000000860000-0x00000000008E9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\522d80 e743667a File opened for modification C:\Windows\f33f0 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e743667a - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e743667a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e743667a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e743667a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e743667a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e743667a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e743667a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e743667a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e743667a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e743667a - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 4800 e743667a 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Token: SeTcbPrivilege 888 caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe Token: SeDebugPrivilege 4800 e743667a Token: SeTcbPrivilege 4800 e743667a
Processes
-
C:\Users\Admin\AppData\Local\Temp\caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe"C:\Users\Admin\AppData\Local\Temp\caa807818c553f2915d7ef3ac6ac4877ab6427a38eae910fe18b221a30c7056e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888
-
C:\Windows\Syswow64\e743667aC:\Windows\Syswow64\e743667a1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\522d80
- Size 506B
- SHA256 4ce382350dea4d1859e8d2395ee3a6c46c121008ce6c82ecbbbc563a8be6aa6b
- MD5 406a151fa9c8614ac59865039c9ec552
- SHA1 7a0b34aad9b14f8b257e6ac946e50f1ec8d24696
- SHA512 f3ba04ca0612ff4a3f5aa10bc7de4822fd7ce8dfe40112f7134ae3ef1529a75bd72c41f4d6f1c1940799d14654afa0f3408daa29a73542b48102e3412e5e3d88
- TLSH T1D0F09EBD9D6AB7D94DAF046A4B06A8442C1AD33F800B71DD7D8037CE08D21D96923C88
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\e743667a
- Size 618KB
- SHA256 52c4662142e99160caf559db0ea22d81a0145112a3cfcb3050758582be2a491e
- MD5 b225df3adcff0456e3126bf8249f0c0a
- SHA1 99d7150a45923ff3907fafa2b2d76429e23a7aa3
- SHA512 eb93ea8d5707ddb022a3f9b8d3618c4db7bcd604dad47d6bfb0f7c0205caf8508a665bf0d6a4ddc36266ea3fc0afa6364aedc20ce8b15bd076a8f0314d49d012
- SSDEEP 12288:0qXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:0jHPOSOkx2LFscUQPxW
- TLSH T161D47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH