Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 19:32
Behavioral task
behavioral1
Sample
9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe
- Size 2.6MB
- Sample260710-x8zddsfx9k
- SHA256 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b
- MD5 3cfa24abfeb7fad250836aa80f474af8
- SHA1 805618621d0a50a0c7ae491d0a18834c36e18dea
- SHA512 9bf506b77acff24c74982790536f810527bec3d124f296cad2263b7a24c24bb120b3583d42a9fb8d0ea14083d69f9d8a94bde4860f6b86ac44a5d3028956d90b
- SSDEEP 49152:KTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:KKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T174C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4344 d21d4f30 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 17 114.114.114.114 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe Destination IP 18 223.5.5.5 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe Destination IP 1 114.114.114.114 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe Destination IP 2 223.5.5.5 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d21d4f30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d21d4f30 File created C:\Windows\SysWOW64\d21d4f30 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe -
resource yara_rule behavioral2/memory/3484-0-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/files/0x0008000000019cc1-2.dat upx behavioral2/memory/4344-3-0x00000000005C0000-0x0000000000649000-memory.dmp upx behavioral2/memory/3484-18-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/4344-20-0x00000000005C0000-0x0000000000649000-memory.dmp upx behavioral2/memory/4344-24-0x00000000005C0000-0x0000000000649000-memory.dmp upx behavioral2/memory/3484-33-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/4344-34-0x00000000005C0000-0x0000000000649000-memory.dmp upx behavioral2/memory/4344-36-0x00000000005C0000-0x0000000000649000-memory.dmp upx behavioral2/memory/3484-43-0x0000000000590000-0x0000000000619000-memory.dmp upx behavioral2/memory/3484-49-0x0000000000590000-0x0000000000619000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4a5ef0 d21d4f30 File opened for modification C:\Windows\3ba5b8 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d21d4f30 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d21d4f30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d21d4f30 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d21d4f30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d21d4f30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d21d4f30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d21d4f30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d21d4f30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d21d4f30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d21d4f30 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4344 d21d4f30 4344 d21d4f30 4344 d21d4f30 4344 d21d4f30 4344 d21d4f30 4344 d21d4f30 4344 d21d4f30 4344 d21d4f30 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe Token: SeTcbPrivilege 3484 9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe Token: SeDebugPrivilege 4344 d21d4f30 Token: SeTcbPrivilege 4344 d21d4f30
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe"C:\Users\Admin\AppData\Local\Temp\9dbcac9d611428373af28e08cae6705182c45301cd73ff8d1c094048fad1905b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
C:\Windows\Syswow64\d21d4f30C:\Windows\Syswow64\d21d4f301⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d21d4f30
- Size 2.6MB
- SHA256 e9a6185d4d59c4c7000e937d8b0ba1301c59f8bf52bc9e1597927fc87ed36c00
- MD5 5768d84cf65d41d50970b292c0ac132b
- SHA1 810366fad8e8dd7e64cafe4823fc89b15a55d757
- SHA512 550813cff5c189bb1b9194d1093c98da2b15ab6a18af50af0952d1306eee72fbf7750f34e61ca2631013a8db6e65a657c2880c4c4a6d30e208d36a0f108c58d5
- SSDEEP 49152:qTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:qKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T14AC59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH