Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/07/2026, 09:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe
- Size 3.6MB
- Sample260724-lbtabswtgs
- SHA256 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e
- MD5 841d0222f54095a73a69d925f815a4d7
- SHA1 34057466ab5b32ccbdb213b59e8d5954aa8c3c40
- SHA512 fd54cb5b90bbbe5a99b9d82a04b19008d0cb6f6fcfea12a3251a2034a60eecc15bafb27513640dd5be561f5010017d14ef51d175d90614546fde8f3f0732e9dc
- SSDEEP 49152:LLo8fgSG5sn+jTb+ZHyOsRHGdFPtA6LS556IhWgY0atBHyptdoYey/osjo9a:PBhGWtP1A3ZLafSptdoZY7jo9a
- TLSH T1C306BE46A2A510E8C1E6F13C89429626F7B37C115710BBCB11A86A66FF33ED11E3E735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Unexpected DNS network traffic destination 43 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 40 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 71 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 12 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 38 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 66 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 73 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 81 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 84 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 88 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 14 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 16 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 27 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 29 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 50 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 56 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 60 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 64 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 26 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 30 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 59 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 65 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 67 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 74 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 75 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 76 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 51 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 58 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 4 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 17 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 39 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 42 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 87 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 3 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 31 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 68 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 85 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 15 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 72 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 86 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 89 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 90 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 18 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Destination IP 37 114.114.114.114 4732 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e bc3a8b2072b1d9c1ca6f92925872b041be11f8bae4a2ad45b4d3a41dbc3b982e.exe