Analysis
- max time kernel
38s - max time network
40s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
40 seconds
Behavioral task
behavioral2
Sample
1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe
- Size 6.5MB
- Sample260722-dffk2axfnc
- SHA256 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a
- MD5 f42db6ffdf93e601e7fd8de6087a9bc2
- SHA1 f4dddf0fee73465efbfaf305482c9b4c1480a529
- SHA512 4fc1feff335ce4fe46273b50367341159c09b335e72bc09b48cf99daad3242cae09e7e5c88ccefea662c274be9c70929d30674cc599726c6eb5a1757cdec6a8e
- SSDEEP 49152:eiQMUqtiuVHM8VogQ8MXiQQLhD+qBC+8hVvALe+MaPujoTpIASRrs7ZGPwL3l+Ng:eirPI4qDAWoTn7xpLtiUKnE
- TLSH T15B664A17FCA524E5C1ADD1308AB69653BB727C891B3123D32B90F6282F76BD0AD79350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemd-resolved.exe 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemd-resolved.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe" 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe - Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ifconfig.me 7 checkip.amazonaws.com 9 icanhazip.com 10 api.ipify.org 11 ipinfo.io - GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 13 Go-http-client/1.1 HTTP User-Agent header 14 Go-http-client/1.1 HTTP User-Agent header 15 Go-http-client/1.1 - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4288 wmic.exe Token: SeSecurityPrivilege 4288 wmic.exe Token: SeTakeOwnershipPrivilege 4288 wmic.exe Token: SeLoadDriverPrivilege 4288 wmic.exe Token: SeSystemProfilePrivilege 4288 wmic.exe Token: SeSystemtimePrivilege 4288 wmic.exe Token: SeProfSingleProcessPrivilege 4288 wmic.exe Token: SeIncBasePriorityPrivilege 4288 wmic.exe Token: SeCreatePagefilePrivilege 4288 wmic.exe Token: SeBackupPrivilege 4288 wmic.exe Token: SeRestorePrivilege 4288 wmic.exe Token: SeShutdownPrivilege 4288 wmic.exe Token: SeDebugPrivilege 4288 wmic.exe Token: SeSystemEnvironmentPrivilege 4288 wmic.exe Token: SeRemoteShutdownPrivilege 4288 wmic.exe Token: SeUndockPrivilege 4288 wmic.exe Token: SeManageVolumePrivilege 4288 wmic.exe Token: 33 4288 wmic.exe Token: 34 4288 wmic.exe Token: 35 4288 wmic.exe Token: 36 4288 wmic.exe Token: SeIncreaseQuotaPrivilege 4288 wmic.exe Token: SeSecurityPrivilege 4288 wmic.exe Token: SeTakeOwnershipPrivilege 4288 wmic.exe Token: SeLoadDriverPrivilege 4288 wmic.exe Token: SeSystemProfilePrivilege 4288 wmic.exe Token: SeSystemtimePrivilege 4288 wmic.exe Token: SeProfSingleProcessPrivilege 4288 wmic.exe Token: SeIncBasePriorityPrivilege 4288 wmic.exe Token: SeCreatePagefilePrivilege 4288 wmic.exe Token: SeBackupPrivilege 4288 wmic.exe Token: SeRestorePrivilege 4288 wmic.exe Token: SeShutdownPrivilege 4288 wmic.exe Token: SeDebugPrivilege 4288 wmic.exe Token: SeSystemEnvironmentPrivilege 4288 wmic.exe Token: SeRemoteShutdownPrivilege 4288 wmic.exe Token: SeUndockPrivilege 4288 wmic.exe Token: SeManageVolumePrivilege 4288 wmic.exe Token: 33 4288 wmic.exe Token: 34 4288 wmic.exe Token: 35 4288 wmic.exe Token: 36 4288 wmic.exe Token: SeIncreaseQuotaPrivilege 4504 wmic.exe Token: SeSecurityPrivilege 4504 wmic.exe Token: SeTakeOwnershipPrivilege 4504 wmic.exe Token: SeLoadDriverPrivilege 4504 wmic.exe Token: SeSystemProfilePrivilege 4504 wmic.exe Token: SeSystemtimePrivilege 4504 wmic.exe Token: SeProfSingleProcessPrivilege 4504 wmic.exe Token: SeIncBasePriorityPrivilege 4504 wmic.exe Token: SeCreatePagefilePrivilege 4504 wmic.exe Token: SeBackupPrivilege 4504 wmic.exe Token: SeRestorePrivilege 4504 wmic.exe Token: SeShutdownPrivilege 4504 wmic.exe Token: SeDebugPrivilege 4504 wmic.exe Token: SeSystemEnvironmentPrivilege 4504 wmic.exe Token: SeRemoteShutdownPrivilege 4504 wmic.exe Token: SeUndockPrivilege 4504 wmic.exe Token: SeManageVolumePrivilege 4504 wmic.exe Token: 33 4504 wmic.exe Token: 34 4504 wmic.exe Token: 35 4504 wmic.exe Token: 36 4504 wmic.exe Token: SeIncreaseQuotaPrivilege 4504 wmic.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3304 wrote to memory of 3116 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 86 PID 3304 wrote to memory of 4288 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 87 PID 3304 wrote to memory of 4504 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 89 PID 3304 wrote to memory of 1232 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 90 PID 3304 wrote to memory of 2600 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 91 PID 3304 wrote to memory of 1000 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 92 PID 3304 wrote to memory of 4424 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 93 PID 3304 wrote to memory of 4632 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 94 PID 3304 wrote to memory of 3052 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 95 PID 3304 wrote to memory of 1148 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 96 PID 3304 wrote to memory of 3816 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 99 PID 3304 wrote to memory of 1388 3304 1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe"C:\Users\Admin\AppData\Local\Temp\1e6df1d48fa798f8791b2a9473655f7bb91006c52e77f760c758850a57c8ab3a.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid2⤵PID:3116
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get AddressWidth2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Manufacturer2⤵PID:1232
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get LoadPercentage2⤵PID:2600
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get TotalVisibleMemorySize2⤵PID:1000
-
-
C:\Windows\System32\Wbem\wmic.exewmic OS get FreePhysicalMemory2⤵PID:4424
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Locale2⤵PID:4632
-
-
C:\Windows\System32\Wbem\wmic.exewmic timezone get Caption2⤵PID:3052
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:1148
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get BuildNumber2⤵PID:3816
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get PCSystemType2⤵PID:1388
-