Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 06:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe
- Size 3.3MB
- Sample260727-g9atesxbre
- SHA256 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33
- MD5 5d7e6b5112e126b2ce5b35346fc2acd9
- SHA1 1fc95f1daa799d756586e252b2328f59678e093b
- SHA512 913dd9f0203124a5a748f04b340ee6e7d79cb5019c9945e55e52e93fe985dfb39bdc509db6fea99d3e39269007a7a52cba7208ebc4ac9e49c420d8d1dfb63797
- SSDEEP 24576:1vO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:1HHKO2FQN///wTGHQd9KFeMxQbzU
- TLSH T17DF54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1920 bd9dab50 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe Destination IP 5 223.5.5.5 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe Destination IP 24 114.114.114.114 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe Destination IP 25 223.5.5.5 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bd9dab50 File created C:\Windows\SysWOW64\bd9dab50 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bd9dab50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bd9dab50 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\20df00 bd9dab50 File opened for modification C:\Windows\60e6b8 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd9dab50 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bd9dab50 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bd9dab50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bd9dab50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bd9dab50 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bd9dab50 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bd9dab50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bd9dab50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bd9dab50 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bd9dab50 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1920 bd9dab50 1920 bd9dab50 1920 bd9dab50 1920 bd9dab50 1920 bd9dab50 1920 bd9dab50 1920 bd9dab50 1920 bd9dab50 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe Token: SeTcbPrivilege 5660 80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe Token: SeDebugPrivilege 1920 bd9dab50 Token: SeTcbPrivilege 1920 bd9dab50
Processes
-
C:\Users\Admin\AppData\Local\Temp\80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe"C:\Users\Admin\AppData\Local\Temp\80a4edabfc70f2954551d25cbcf25359b9013a579e8aeca425d2917e0daddf33.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5660
-
C:\Windows\Syswow64\bd9dab50C:\Windows\Syswow64\bd9dab501⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\bd9dab50
- Size 3.3MB
- SHA256 3b10a718d196c854d4a34fef407d75ab90c04e2282432265885f09e077ee109a
- MD5 ed6e38c263e03589ede09c2efaf10ff4
- SHA1 c88fd5cbb817e3dedaa5fbcac23879c1af2ba1cb
- SHA512 d45624f06e836289f9148377b11e2b00e6287a5d274c0058b7a6fd338dbbc8664998a838ce51f5169dfb792a965259fa66ce9b17c6ccfebdd6042c2f519e1364
- SSDEEP 24576:pvO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:pHHKO2FQN///wTGHQd9KFeMxQbzU
- TLSH T1B6F54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
- MD5 SHA1 SHA512 SSDEEP TLSH