Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 22:41
Behavioral task
behavioral1
Sample
cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe
- Size 618KB
- Sample260709-2mlmmaav4m
- SHA256 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572
- MD5 32ac54d4611154c12c731559ab77da05
- SHA1 bfdf9b15a556ad7d489bd149462c858a6d833358
- SHA512 e410ff2755c54b79f00dbfd7026ba55b2910697abb11eb020d0222dc62169893c263f39dcd5800d824e5f9a51758003b30a9619e592eb269e6c79fe00c5d129b
- SSDEEP 12288:mqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:mjHPOSOkx2LFscUQPxW
- TLSH T1FDD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3208 a9d25a3c - Unexpected DNS network traffic destination 14 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 36 223.5.5.5 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 63 114.114.114.114 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 64 223.5.5.5 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 122 114.114.114.114 3208 a9d25a3c Destination IP 130 223.5.5.5 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 200 114.114.114.114 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 256 114.114.114.114 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 1 114.114.114.114 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 35 114.114.114.114 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 123 114.114.114.114 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 124 223.5.5.5 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 201 223.5.5.5 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 257 223.5.5.5 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Destination IP 2 223.5.5.5 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a9d25a3c File created C:\Windows\SysWOW64\a9d25a3c cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a9d25a3c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a9d25a3c -
resource yara_rule behavioral2/memory/5960-0-0x0000000000C00000-0x0000000000C89000-memory.dmp upx behavioral2/files/0x000a00000001b85c-2.dat upx behavioral2/memory/3208-3-0x0000000000A70000-0x0000000000AF9000-memory.dmp upx behavioral2/memory/5960-16-0x0000000000C00000-0x0000000000C89000-memory.dmp upx behavioral2/memory/3208-18-0x0000000000A70000-0x0000000000AF9000-memory.dmp upx behavioral2/memory/3208-22-0x0000000000A70000-0x0000000000AF9000-memory.dmp upx behavioral2/memory/5960-23-0x0000000000C00000-0x0000000000C89000-memory.dmp upx behavioral2/memory/5960-39-0x0000000000C00000-0x0000000000C89000-memory.dmp upx behavioral2/memory/3208-40-0x0000000000A70000-0x0000000000AF9000-memory.dmp upx behavioral2/memory/5960-43-0x0000000000C00000-0x0000000000C89000-memory.dmp upx behavioral2/memory/3208-48-0x0000000000A70000-0x0000000000AF9000-memory.dmp upx behavioral2/memory/3208-49-0x0000000000A70000-0x0000000000AF9000-memory.dmp upx behavioral2/memory/5960-50-0x0000000000C00000-0x0000000000C89000-memory.dmp upx behavioral2/memory/5960-54-0x0000000000C00000-0x0000000000C89000-memory.dmp upx behavioral2/memory/5960-56-0x0000000000C00000-0x0000000000C89000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\36ec10 a9d25a3c File opened for modification C:\Windows\660990 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9d25a3c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a9d25a3c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a9d25a3c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a9d25a3c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a9d25a3c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a9d25a3c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a9d25a3c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a9d25a3c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a9d25a3c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a9d25a3c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3208 a9d25a3c 3208 a9d25a3c 3208 a9d25a3c 3208 a9d25a3c 3208 a9d25a3c 3208 a9d25a3c 3208 a9d25a3c 3208 a9d25a3c 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Token: SeTcbPrivilege 5960 cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe Token: SeDebugPrivilege 3208 a9d25a3c Token: SeTcbPrivilege 3208 a9d25a3c
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe"C:\Users\Admin\AppData\Local\Temp\cbd85899623ee7b1e7ca4438d66b46128c8b83a5d1485648b46c493486326572.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5960
-
C:\Windows\Syswow64\a9d25a3cC:\Windows\Syswow64\a9d25a3c1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a9d25a3c
- Size 618KB
- SHA256 2ff50f0959ac1c7551ede934ef1f43cab3fb76d2a068679c9f8d8a68629f7e34
- MD5 cc3fd8eaae6be43ef0915ae3dc20981a
- SHA1 e831a8d1d85af3b0418900a4f7c16791b8691983
- SHA512 60f0a736785a4672417f3582c5b532c271d742c12eec69ead278338904ad75c0aef3295816025d90303f2c924635883e1f3ac4838c47925080e5fea4c6634978
- SSDEEP 12288:fqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:fjHPOSOkx2LFscUQPxW
- TLSH T10ED47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH