Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 21:31
Behavioral task
behavioral1
Sample
15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe
- Size 576KB
- Sample260718-1c3bysdt5p
- SHA256 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939
- MD5 49b8b17933366d995956cd2b89316785
- SHA1 b3831962a84b15d3a99c02a9c8810b159b12cdba
- SHA512 0d15dd74eb52f48d08762ed10a5d8d38d89485ff66c8942af2a309b17374e9891c44bc2682bda75c22ec0efc4f04121bb4ab3a62766e8211930464fef3e2dd2d
- SSDEEP 6144:zcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:zSvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T1E8C46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4448 58f3c6b0 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Destination IP 11 114.114.114.114 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Destination IP 12 223.5.5.5 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Destination IP 67 114.114.114.114 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Destination IP 68 223.5.5.5 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Destination IP 1 114.114.114.114 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 58f3c6b0 File created C:\Windows\SysWOW64\58f3c6b0 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 58f3c6b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 58f3c6b0 -
resource yara_rule behavioral2/memory/1436-0-0x0000000000560000-0x00000000005EC000-memory.dmp upx behavioral2/files/0x000b000000019caa-2.dat upx behavioral2/memory/4448-3-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx behavioral2/memory/1436-10-0x0000000000560000-0x00000000005EC000-memory.dmp upx behavioral2/memory/4448-11-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx behavioral2/memory/4448-36-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4c26c0 58f3c6b0 File opened for modification C:\Windows\1895b8 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58f3c6b0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 58f3c6b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 58f3c6b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 58f3c6b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 58f3c6b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 58f3c6b0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 58f3c6b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 58f3c6b0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 58f3c6b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 58f3c6b0 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4448 58f3c6b0 4448 58f3c6b0 4448 58f3c6b0 4448 58f3c6b0 4448 58f3c6b0 4448 58f3c6b0 4448 58f3c6b0 4448 58f3c6b0 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Token: SeTcbPrivilege 1436 15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe Token: SeDebugPrivilege 4448 58f3c6b0 Token: SeTcbPrivilege 4448 58f3c6b0
Processes
-
C:\Users\Admin\AppData\Local\Temp\15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe"C:\Users\Admin\AppData\Local\Temp\15040f3997ed339a1d6109f08c880200d96e4f23bca6b04e68799a4f4952e939.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
C:\Windows\Syswow64\58f3c6b0C:\Windows\Syswow64\58f3c6b01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\58f3c6b0
- Size 576KB
- SHA256 d1dee9351dbdebb6aec5c088378218f8ad466a259e6c387cb827079aa59615f3
- MD5 2cdfb4dff0f7533dcb9291a19801c643
- SHA1 d4b6ecb566dabefe1b800f7378bea499ebeda55c
- SHA512 48672abc016c40d61a4a0976d776b69598a196f0a63c49e11a87f7168ff0523a3a1cb796c313b2007edace15fe45a87d3b11c6d927e91a56ba59c24da2dbe381
- SSDEEP 6144:wcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:wSvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T17AC46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH