Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/07/2026, 23:45
Behavioral task
behavioral1
Sample
e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe
- Size 1.4MB
- Sample260719-3rv8asbv21
- SHA256 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8
- MD5 d15d80ef8e19fac2064eeed4968e4f61
- SHA1 156a618eca496de2f4ca20cd9e6991622236e6c9
- SHA512 0527bf9d58541a5cb58d811e83a9159fcb7552444111a98649f501338820597b8033bae253cbbae92a9b643dbaca04f695e17aaf9fa304251cba056cb8e8f4b1
- SSDEEP 24576:NjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:NTGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T1E0658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4256 27129eda - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Destination IP 33 114.114.114.114 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Destination IP 35 223.5.5.5 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Destination IP 3 114.114.114.114 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe - Drops file in System32 directory 19 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 27129eda File created C:\Windows\SysWOW64\27129eda e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 27129eda File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 27129eda -
resource yara_rule behavioral1/memory/4260-0-0x0000000000190000-0x0000000000219000-memory.dmp upx behavioral1/files/0x001f000000024338-2.dat upx behavioral1/memory/4256-4-0x00000000000D0000-0x0000000000159000-memory.dmp upx behavioral1/memory/4260-14-0x0000000000190000-0x0000000000219000-memory.dmp upx behavioral1/memory/4256-16-0x00000000000D0000-0x0000000000159000-memory.dmp upx behavioral1/memory/4260-38-0x0000000000190000-0x0000000000219000-memory.dmp upx behavioral1/memory/4256-39-0x00000000000D0000-0x0000000000159000-memory.dmp upx behavioral1/memory/4260-55-0x0000000000190000-0x0000000000219000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\48dd40 27129eda File opened for modification C:\Windows\48eec8 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27129eda - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 27129eda Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 27129eda Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 27129eda Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 27129eda Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 27129eda Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 27129eda Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 27129eda Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 27129eda Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 27129eda - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 27129eda Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 27129eda - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4256 27129eda 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Token: SeTcbPrivilege 4260 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Token: SeDebugPrivilege 4256 27129eda Token: SeTcbPrivilege 4256 27129eda
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe"C:\Users\Admin\AppData\Local\Temp\e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
C:\Windows\Syswow64\27129edaC:\Windows\Syswow64\27129eda1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\27129eda
- Size 1.4MB
- SHA256 2d91ee251dfe418aade8c7863f353cfdbc90e0aecc8dbd3c951f432ffc622a44
- MD5 ddbc007065ef8933c7b71fd5bc15e5db
- SHA1 65d80fa55502800cd60966473f53de6025ecd698
- SHA512 6c4e5695981b525d20d5cf1ff23a79e0d44d30b309ac8e7afe1f6011a2d5b34d3b9e7d0a1ec1b5c400303c0f360e1fc098df9d6679771d32e53161ae0005fea2
- SSDEEP 24576:ZjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:ZTGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T1A8658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH