Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 23:45
Behavioral task
behavioral1
Sample
e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe
- Size 1.4MB
- Sample260719-3rv8asbv21
- SHA256 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8
- MD5 d15d80ef8e19fac2064eeed4968e4f61
- SHA1 156a618eca496de2f4ca20cd9e6991622236e6c9
- SHA512 0527bf9d58541a5cb58d811e83a9159fcb7552444111a98649f501338820597b8033bae253cbbae92a9b643dbaca04f695e17aaf9fa304251cba056cb8e8f4b1
- SSDEEP 24576:NjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:NTGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T1E0658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3240 86e74c8c - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Destination IP 2 223.5.5.5 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Destination IP 12 114.114.114.114 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Destination IP 13 223.5.5.5 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 86e74c8c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 86e74c8c File created C:\Windows\SysWOW64\86e74c8c e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe -
resource yara_rule behavioral2/memory/4748-0-0x0000000000380000-0x0000000000409000-memory.dmp upx behavioral2/files/0x001200000001122a-4.dat upx behavioral2/memory/3240-3-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral2/memory/4748-15-0x0000000000380000-0x0000000000409000-memory.dmp upx behavioral2/memory/3240-17-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral2/memory/4748-33-0x0000000000380000-0x0000000000409000-memory.dmp upx behavioral2/memory/3240-34-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral2/memory/3240-36-0x00000000002E0000-0x0000000000369000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\377850 86e74c8c File opened for modification C:\Windows\514998 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86e74c8c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 86e74c8c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 86e74c8c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 86e74c8c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 86e74c8c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 86e74c8c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 86e74c8c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 86e74c8c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 86e74c8c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 86e74c8c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3240 86e74c8c 3240 86e74c8c 3240 86e74c8c 3240 86e74c8c 3240 86e74c8c 3240 86e74c8c 3240 86e74c8c 3240 86e74c8c 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Token: SeTcbPrivilege 4748 e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe Token: SeDebugPrivilege 3240 86e74c8c Token: SeTcbPrivilege 3240 86e74c8c
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe"C:\Users\Admin\AppData\Local\Temp\e8401b146e9de3ab23a04e10db0de96380a5aa7664b2832efabde7500443cca8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
C:\Windows\Syswow64\86e74c8cC:\Windows\Syswow64\86e74c8c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\86e74c8c
- Size 1.4MB
- SHA256 43c47ce6d689c47e661d4f96cfbaf4cba5a39b4b466d9003cd3d2d42f87bcc68
- MD5 e19d9c2db51084f0a26346cd31cde93a
- SHA1 1ea30a6d8c96329be457f82a702d1958ec500c5b
- SHA512 24ae09c269ba11014069ce5827c0583d5c02de4e3cb166632087b239ab9e295ea9ea673be1fb300da95a4a22fc82fe8445053adfcf7b0e6fb62cb79255113855
- SSDEEP 24576:6jHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:6TGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T161658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH