Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 19:10
Behavioral task
behavioral1
Sample
31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe
- Size 560KB
- Sample260721-xvmgnsshpf
- SHA256 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca
- MD5 e335d19c31a959c3bed85431bed825f6
- SHA1 ff7b1f350fa9ab9cfd1b70889386e432768583bf
- SHA512 dbe429c90b00f5737c7e31b875c6ab5e8c21d5e1db8890db36f08195fa9487f07b4495ad1671793e8849f6274baff87a5e263f23ba6cc54d8a3dcdc773a8a1e0
- SSDEEP 6144:O4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:OrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T179C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5840 e64af7f6 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 41 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 42 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 96 114.114.114.114 5840 e64af7f6 Destination IP 163 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 236 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 237 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 3 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 377 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 378 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 100 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 323 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 324 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 97 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 98 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 161 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 293 114.114.114.114 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Destination IP 294 223.5.5.5 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e64af7f6 File created C:\Windows\SysWOW64\e64af7f6 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e64af7f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e64af7f6 -
resource yara_rule behavioral2/memory/2820-0-0x00000000005D0000-0x000000000065C000-memory.dmp upx behavioral2/files/0x000700000001b871-2.dat upx behavioral2/memory/5840-3-0x0000000000C30000-0x0000000000CBC000-memory.dmp upx behavioral2/memory/2820-16-0x00000000005D0000-0x000000000065C000-memory.dmp upx behavioral2/memory/5840-17-0x0000000000C30000-0x0000000000CBC000-memory.dmp upx behavioral2/memory/5840-38-0x0000000000C30000-0x0000000000CBC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\304788 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe File opened for modification C:\Windows\63fba0 e64af7f6 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e64af7f6 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e64af7f6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e64af7f6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e64af7f6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e64af7f6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e64af7f6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e64af7f6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e64af7f6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e64af7f6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e64af7f6 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5840 e64af7f6 5840 e64af7f6 5840 e64af7f6 5840 e64af7f6 5840 e64af7f6 5840 e64af7f6 5840 e64af7f6 5840 e64af7f6 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Token: SeTcbPrivilege 2820 31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe Token: SeDebugPrivilege 5840 e64af7f6 Token: SeTcbPrivilege 5840 e64af7f6
Processes
-
C:\Users\Admin\AppData\Local\Temp\31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe"C:\Users\Admin\AppData\Local\Temp\31a579e34141a32e9418bb27700bcab53c74c2128112e19dcec68a225bc895ca.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
C:\Windows\Syswow64\e64af7f6C:\Windows\Syswow64\e64af7f61⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e64af7f6
- Size 560KB
- SHA256 d318ed386f347e8ce0ff18b4e92c15d6145380faafcc1faf1320f16c6a1dabfa
- MD5 7c6521afd1dde9545392792195b650e3
- SHA1 ad4683164fd704ba3b0c6b5d90dd0a0f8b355a6c
- SHA512 dbe017b6464debeb29991356c32e6f1111ff2232dd0ce3727273ac05f10d874d9dbd011b286b0f4b8aefc98ddd814686b03f9d7dd6436ca4aa5d2bc076d7976c
- SSDEEP 6144:z4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:zrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T12BC48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH