Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 23:49
Behavioral task
behavioral1
Sample
d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe
- Size 525KB
- Sample260728-3vhrda1vbw
- SHA256 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf
- MD5 5e779b049f6d00c3a9fe89cf4c178f4f
- SHA1 5495a056b67cc13a333b22b0d4dcbb59d31d1699
- SHA512 078fd68df7e3290cfe42c63baca09e146849ca67f20342eb54983c22eff4c064d97db089265a84ed807528faf76d2354bd30ecc39e3d8e86eecd6ec72f2b9323
- SSDEEP 6144:BcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:BSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T161B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1068 e0e0f9de - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 223.5.5.5 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe Destination IP 20 114.114.114.114 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe Destination IP 21 223.5.5.5 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe Destination IP 1 114.114.114.114 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e0e0f9de File created C:\Windows\SysWOW64\e0e0f9de d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e0e0f9de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e0e0f9de -
resource yara_rule behavioral2/memory/8-0-0x0000000000910000-0x000000000099C000-memory.dmp upx behavioral2/files/0x000a000000011390-2.dat upx behavioral2/memory/1068-3-0x0000000000770000-0x00000000007FC000-memory.dmp upx behavioral2/memory/8-25-0x0000000000910000-0x000000000099C000-memory.dmp upx behavioral2/memory/1068-26-0x0000000000770000-0x00000000007FC000-memory.dmp upx behavioral2/memory/1068-45-0x0000000000770000-0x00000000007FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1248d8 e0e0f9de File opened for modification C:\Windows\2310 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0e0f9de - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e0e0f9de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e0e0f9de Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e0e0f9de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e0e0f9de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e0e0f9de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e0e0f9de Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e0e0f9de Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e0e0f9de Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e0e0f9de - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 1068 e0e0f9de 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe Token: SeTcbPrivilege 8 d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe Token: SeDebugPrivilege 1068 e0e0f9de Token: SeTcbPrivilege 1068 e0e0f9de
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe"C:\Users\Admin\AppData\Local\Temp\d6390dc84f66a7d9eb0a01628340a10964de866ed8d6d1cdcf81433a4dcc64cf.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
C:\Windows\Syswow64\e0e0f9deC:\Windows\Syswow64\e0e0f9de1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1248d8
- Size 1KB
- SHA256 a7b8175c0b452ca7090553f046b075364254d8baa80579e42561f63c506d8349
- MD5 f88832e8e1acc5d66dc126d885b9b312
- SHA1 52053d8d93a639f0f1dc721712db15793caa4752
- SHA512 4f089866f5baddde99d00813b28df6c7628205667c8a0a4be2b39461655bb31d406e3876a8399a48f6ecf66bc9a51657c7143400321c77e92bb12c8da5bb97ba
- TLSH T10821103DB8FC28F05AFE4B955E43CCC4B536B03B0185905A00AB29E760E799A9856636
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\e0e0f9de
- Size 525KB
- SHA256 8c1f27f051661ed8caf9bf646d1b3b190ca4bbc46df547a9c5a140a369e4782d
- MD5 44acb5b54f9f2939e37a7b349597a7c6
- SHA1 afbac212d8f58125c5b3af14357657ce130f47e9
- SHA512 ea01dd21f0c2f621906138a43173d073d7dcaab101281d5bb126a9126bfb98f384d941f68b47cc4836f8ac14fd6c231576c039d90f43bc36602bd8640e069f61
- SSDEEP 6144:TcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:TSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T199B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH