Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe
- Size 2.4MB
- Sample260709-2gpgbsbw4t
- SHA256 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f
- MD5 437701b49c122f301b66c6de044c71d5
- SHA1 97df788e359addc91af1f438df4d1ad1428263cd
- SHA512 86a1e2588b6c437f9a212fbe25541cc6212646445d997fa04bb00adadec9899c9becb0172b58f1de37763f43c1a197c18db6b811c377ad3794abc6038140da8d
- SSDEEP 49152:YHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:YnKdVkOhCXHHFZMjHfUKkVWsi
- TLSH T183B58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4576 590d0c5b - Unexpected DNS network traffic destination 14 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 34 114.114.114.114 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 65 114.114.114.114 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 118 114.114.114.114 4576 590d0c5b Destination IP 122 114.114.114.114 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 123 223.5.5.5 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 126 223.5.5.5 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 257 114.114.114.114 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 1 114.114.114.114 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 2 223.5.5.5 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 35 223.5.5.5 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 66 223.5.5.5 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 201 114.114.114.114 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 202 223.5.5.5 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Destination IP 258 223.5.5.5 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 590d0c5b File created C:\Windows\SysWOW64\590d0c5b e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 590d0c5b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 590d0c5b - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4e57c0 590d0c5b File opened for modification C:\Windows\50e068 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 590d0c5b Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 590d0c5b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 590d0c5b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 590d0c5b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 590d0c5b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 590d0c5b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 590d0c5b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 590d0c5b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 590d0c5b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 590d0c5b - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4576 590d0c5b 4576 590d0c5b 4576 590d0c5b 4576 590d0c5b 4576 590d0c5b 4576 590d0c5b 4576 590d0c5b 4576 590d0c5b 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Token: SeTcbPrivilege 4724 e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe Token: SeDebugPrivilege 4576 590d0c5b Token: SeTcbPrivilege 4576 590d0c5b
Processes
-
C:\Users\Admin\AppData\Local\Temp\e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe"C:\Users\Admin\AppData\Local\Temp\e65d7f27eaae68c5d0f5f2c94331d90d9506306cbb3ea99f21e4604ff765d33f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
C:\Windows\Syswow64\590d0c5bC:\Windows\Syswow64\590d0c5b1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\590d0c5b
- Size 2.4MB
- SHA256 b0b95aaebb12ffcf69d72b9e7b3582bb1dad7782ce5736d7b9c4e8e0c3af2ff0
- MD5 6f8829144c2378269a3043924ae859c5
- SHA1 7ed8c30e948bffced11114a185d767deabeaaea2
- SHA512 9d5bf72c295e2a036e83d7b02a2a40c349be4bf3c716d02c83a707fc679d26d8620590e8f2f068d95217aaed9ad46dd92623e2ea498df4da62636878c23fec04
- SSDEEP 49152:0HHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:0nKdVkOhCXHHFZMjHfUKkVWsi
- TLSH T1EFB58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH