Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 00:06
Behavioral task
behavioral1
Sample
147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe
- Size 766KB
- Sample260723-adyr2sdh77
- SHA256 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c
- MD5 af0deba9752f05bb47d49fd4483ae20e
- SHA1 e06382e3f8c8658faa940316760d8a1c9cda5897
- SHA512 7009c3d5f3923a647d1c61cc5b837cdf051826a69276bc7e658bc38d1d008c9b943d98462e398caeac50142867cf552814a60217696be5a4faeff7988e9b59de
- SSDEEP 12288:PSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:6vO2xJKRw2kOkx2LFRvcUV
- TLSH T18DF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5980 41b7b072 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe Destination IP 4 223.5.5.5 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe Destination IP 13 114.114.114.114 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe Destination IP 14 223.5.5.5 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 41b7b072 File created C:\Windows\SysWOW64\41b7b072 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 41b7b072 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 41b7b072 -
resource yara_rule behavioral2/memory/4824-0-0x00000000009E0000-0x0000000000A6C000-memory.dmp upx behavioral2/files/0x0008000000019cc1-2.dat upx behavioral2/memory/5980-3-0x0000000000670000-0x00000000006FC000-memory.dmp upx behavioral2/memory/4824-17-0x00000000009E0000-0x0000000000A6C000-memory.dmp upx behavioral2/memory/5980-18-0x0000000000670000-0x00000000006FC000-memory.dmp upx behavioral2/memory/5980-45-0x0000000000670000-0x00000000006FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\666138 41b7b072 File opened for modification C:\Windows\5296b0 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41b7b072 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 41b7b072 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 41b7b072 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 41b7b072 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 41b7b072 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 41b7b072 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 41b7b072 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 41b7b072 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 41b7b072 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 41b7b072 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 5980 41b7b072 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe Token: SeTcbPrivilege 4824 147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe Token: SeDebugPrivilege 5980 41b7b072 Token: SeTcbPrivilege 5980 41b7b072
Processes
-
C:\Users\Admin\AppData\Local\Temp\147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe"C:\Users\Admin\AppData\Local\Temp\147bbedadcb883808f9beb1cdcb00d62e61889f494deaacc8ad5291d1942ff6c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
C:\Windows\Syswow64\41b7b072C:\Windows\Syswow64\41b7b0721⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5980
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\666138
- Size 916B
- SHA256 ba0ae199368243b35e43cea002d5eff12581d391dbf312be685a8aef9fb30d63
- MD5 3863decd986d5fbd10eebce8ccafda46
- SHA1 401d743d5637554c46189a3ae427a6509da16af5
- SHA512 e1d70115404a3e610c66fb161a5f28ddd654cb73b528d720b42fa4ac54940eb83b62989cdae0652ff1cd0cf8e516cdfa640f7396119cb29961bc245c42a35ae4
- TLSH T130115CB77C89B2D624F59564A4D10EDFF33074C8C9D9406BCEE02C9028632A6CC1711F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\41b7b072
- Size 766KB
- SHA256 0ec8b4d13b40dae81b339180ec6268657b8387e4961d7e4a68eaf6e06b9184c3
- MD5 53ddfc6743691185a7ddf4b84debc6dd
- SHA1 7427df6c0cbc72705be0630e18052ca87d78fd26
- SHA512 20c958b20e72797ea1a1e401bf1a7cadd315c759243eaf3759eb7b3e9a55cd84b17effb5eacfa60c0bff637d8527b3e9104f99733098b9406ad051c6546f10b5
- SSDEEP 12288:hSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:ovO2xJKRw2kOkx2LFRvcUV
- TLSH T1F4F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH