Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 19:01
Behavioral task
behavioral1
Sample
b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe
- Size 576KB
- Sample260717-xpqbdafv7w
- SHA256 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d
- MD5 8d3051e6fcd2724e502105d48c393667
- SHA1 dbb838cc86b79d085c41d796262feff2f50c6ac8
- SHA512 fa7f1466eb40c4489efa4ffbf095f10dc0180dc5c95990fc2aeb2aff77253b60cc876ab7b547747bff455315db6c18cea3f5c704d5e0515ccc5474dc9ad8e9bb
- SSDEEP 6144:ZcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:ZSvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T198C46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5096 91a84d28 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe Destination IP 3 223.5.5.5 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe Destination IP 21 114.114.114.114 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe Destination IP 22 223.5.5.5 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 91a84d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 91a84d28 File created C:\Windows\SysWOW64\91a84d28 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 91a84d28 -
resource yara_rule behavioral2/memory/2980-0-0x0000000000460000-0x00000000004EC000-memory.dmp upx behavioral2/files/0x000a00000000083c-2.dat upx behavioral2/memory/5096-4-0x0000000000020000-0x00000000000AC000-memory.dmp upx behavioral2/memory/2980-20-0x0000000000460000-0x00000000004EC000-memory.dmp upx behavioral2/memory/5096-21-0x0000000000020000-0x00000000000AC000-memory.dmp upx behavioral2/memory/5096-39-0x0000000000020000-0x00000000000AC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3304c8 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe File opened for modification C:\Windows\573ed0 91a84d28 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91a84d28 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 91a84d28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 91a84d28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 91a84d28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 91a84d28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 91a84d28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 91a84d28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 91a84d28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 91a84d28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 91a84d28 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 5096 91a84d28 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe Token: SeTcbPrivilege 2980 b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe Token: SeDebugPrivilege 5096 91a84d28 Token: SeTcbPrivilege 5096 91a84d28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe"C:\Users\Admin\AppData\Local\Temp\b49e1eaed5f415c169a977cf62b09ff126226f083a10bc7950094fb0f2af689d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
C:\Windows\Syswow64\91a84d28C:\Windows\Syswow64\91a84d281⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\573ed0
- Size 916B
- SHA256 d3aeff57288f43c265f6490e61559af68afb5084ed07717278ea811ada683236
- MD5 cea16e4abfda991b43cc64a0435947ae
- SHA1 37a2367b06d84eb5853508e7b2c4866cb09bd6ec
- SHA512 2732aa48ee3654455ff74a52805add29f1fc583de802c837779f89bcde39236969b7acf7eca2e79697e49c7217e13f0bbaebd754d7936183fed2f082cfcc90dc
- TLSH T15C11E2221474DAB2ECFB037576E288CCBF317897C6DA061309D75183A9A2618C41B052
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\91a84d28
- Size 576KB
- SHA256 e3a5d9abf3db4fc75886acc036c9eb76e47e2fab656ef59266806024b0a6dc03
- MD5 3ec61e3d32e043a1a157435b4fc5a81c
- SHA1 9ba8966d78ce17f5eaec629be47feb614a417737
- SHA512 d05b9607b9e8930015d73da795d8e39cca1b5bad2a8df6242d2b2b74d8b39c06210958038d983568651c2b31cf39d55e120514c1580a59384536997557e5bb2e
- SSDEEP 6144:HcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:HSvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T179C46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH