Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe
- Size 1.8MB
- Sample260714-ldmkkacv4y
- SHA256 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16
- MD5 48118857d4c0579f935beca69a147d99
- SHA1 ee52f492f61e48139eb0a299fea5c0a14de1c47a
- SHA512 d3271bbd6c23f3ed7adaabc907ddb805e516c8e7d1469baf719117b7b7d435bdeaaad43b581769e26c50e960224ef6e69c3fd893c39754865de329eeb19fea4d
- SSDEEP 49152:tHHKO29Qm5QZuTtS0rQMYOQ+q8CEKTG4QN:tnKdtWsM0r1QnxK4e
- TLSH T1FE85AE21B351C036D4AB01758ABA47AEA578BD21472551CBB3D47B7E1FB23D2AE3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2208 a9dba7e2 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe Destination IP 2 223.5.5.5 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe Destination IP 31 114.114.114.114 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe Destination IP 32 223.5.5.5 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a9dba7e2 File created C:\Windows\SysWOW64\a9dba7e2 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a9dba7e2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a9dba7e2 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\25cd40 a9dba7e2 File opened for modification C:\Windows\15b568 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9dba7e2 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a9dba7e2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a9dba7e2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a9dba7e2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a9dba7e2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a9dba7e2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a9dba7e2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a9dba7e2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a9dba7e2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a9dba7e2 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2208 a9dba7e2 2208 a9dba7e2 2208 a9dba7e2 2208 a9dba7e2 2208 a9dba7e2 2208 a9dba7e2 2208 a9dba7e2 2208 a9dba7e2 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe Token: SeTcbPrivilege 1268 c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe Token: SeDebugPrivilege 2208 a9dba7e2 Token: SeTcbPrivilege 2208 a9dba7e2
Processes
-
C:\Users\Admin\AppData\Local\Temp\c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe"C:\Users\Admin\AppData\Local\Temp\c90401a53727c4b6b8dc9505022d7107b85f24a77b1d5815a79f3f109c38fb16.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
C:\Windows\Syswow64\a9dba7e2C:\Windows\Syswow64\a9dba7e21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a9dba7e2
- Size 1.8MB
- SHA256 2b9be2ebc3eba3520d23d07e01741d85a63efa28aae63278b4280b8de7db5029
- MD5 fbca58ca41822f82015949c7c96a8183
- SHA1 88ac2e611094392de0f8741e1c1b7cd9c55d0f77
- SHA512 0ee1dc262ba8bd859716d420140aa41b575e0e0642288293d884274206a276b78c8db3a72497f18d2c3874c0b17f6731510b3f2f90f69d4d12add94918571a83
- SSDEEP 49152:hHHKO29Qm5QZuTtS0rQMYOQ+q8CEKTG4QN:hnKdtWsM0r1QnxK4e
- TLSH T1CC85AE21B351C036D4AB01758ABA47AEA578BD21472551CBB3D47B7E1FB23D2AE3130E
- MD5 SHA1 SHA512 SSDEEP TLSH