Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 20:02
Behavioral task
behavioral1
Sample
09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe
- Size 1.4MB
- Sample260719-ysbstsay9m
- SHA256 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d
- MD5 65e84ef8585054e22512a34533a71f59
- SHA1 aebe07552ce1bdf7a079d764d888927535d01cd9
- SHA512 242733d2a4b465f3b28af640842d99ebca4f2901ecf1510290a26f2c73965139d531b0f0f379b1444cbd908f10fa2202cb41a15b23f407de531d71a1c3d9b8e4
- SSDEEP 24576:NjHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA0I:NTGkQy5QZuTtS0rQMYOQ+q8CE0I
- TLSH T1A465AE21B341C036D59A01758ABE4BAE957CBD314B2551C7B3C87E7E6FB12D2AA3130B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5264 c23ce364 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe Destination IP 21 114.114.114.114 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe Destination IP 22 223.5.5.5 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe Destination IP 1 114.114.114.114 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\c23ce364 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c23ce364 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c23ce364 -
resource yara_rule behavioral2/memory/3304-0-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx behavioral2/files/0x000600000001b85f-2.dat upx behavioral2/memory/5264-3-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral2/memory/3304-16-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx behavioral2/memory/5264-18-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral2/memory/5264-22-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral2/memory/3304-37-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx behavioral2/memory/5264-38-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral2/memory/5264-40-0x00000000004B0000-0x0000000000539000-memory.dmp upx behavioral2/memory/3304-41-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx behavioral2/memory/3304-47-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5a1f20 c23ce364 File opened for modification C:\Windows\3890d0 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c23ce364 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c23ce364 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c23ce364 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c23ce364 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c23ce364 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c23ce364 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c23ce364 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c23ce364 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c23ce364 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c23ce364 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5264 c23ce364 5264 c23ce364 5264 c23ce364 5264 c23ce364 5264 c23ce364 5264 c23ce364 5264 c23ce364 5264 c23ce364 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe Token: SeTcbPrivilege 3304 09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe Token: SeDebugPrivilege 5264 c23ce364 Token: SeTcbPrivilege 5264 c23ce364
Processes
-
C:\Users\Admin\AppData\Local\Temp\09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe"C:\Users\Admin\AppData\Local\Temp\09cb597d331b07cbb54d34f3fbffc1b67d387bd0f01339c42c66eef9a0c2371d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
C:\Windows\Syswow64\c23ce364C:\Windows\Syswow64\c23ce3641⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c23ce364
- Size 1.4MB
- SHA256 2f09561e3082c0f7d1c401d70749336c15f19bb89c2a6b26d5c1cb6817b07e68
- MD5 d3594359dcd0fe3ee38f80ba30513770
- SHA1 34bf96067bd4cf231f901f2c27f869d40ca5bab8
- SHA512 d4f49e217e1aa3c29adbe74a5c44bda1bd2e037d7d13ca58c282729529f01302ace58d7b352a74ac0d0c0be8f7a21d7341d99bb090b36ee1bf951a17c35297b0
- SSDEEP 24576:ljHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA0I:lTGkQy5QZuTtS0rQMYOQ+q8CE0I
- TLSH T1DB65AE21B341C036D59A01758ABE4BAE957CBD314B2551C7B3C87E7E6FB12D2AA3130B
- MD5 SHA1 SHA512 SSDEEP TLSH